EUVD-2026-38087
GHSA-fp2r-x59w-m577
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Remote unauthenticated network input with low complexity and no user interaction justifies AV:N/AC:L/PR:N/UI:N; impact is tampering only, so I:H with C:N and A:N.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.
AnalysisAI
Command injection in Microsoft 365 Copilot lets a remote, unauthenticated attacker tamper with data and integrity over the network by injecting unneutralized special elements into a command (CWE-77). The flaw carries a CVSS 7.5 driven entirely by high integrity impact, with no confidentiality or availability loss. There is no public exploit identified at time of analysis, EPSS estimates only a 0.39% 30-day exploitation probability, and CISA's SSVC scores exploitation as none - but a vendor patch is available.
Technical ContextAI
The affected product is Microsoft's 365 Copilot AI assistant (CPE cpe:2.3:a:microsoft:365_copilot), a cloud-delivered generative-AI service embedded across the Microsoft 365 suite. The root cause is CWE-77 (improper neutralization of special elements used in a command), meaning attacker-controlled input reaches a command-construction or command-execution context without adequate sanitization, allowing crafted special characters to alter the intended command. In an LLM/agent context this class commonly manifests as prompt- or instruction-injection that is then translated into a backend command or tool invocation; the network attack vector and lack of required privileges are consistent with input arriving through normal service interfaces. Because this is a Microsoft-hosted service, the fix is delivered server-side rather than as a customer-installed update.
RemediationAI
Patch available per vendor advisory: Microsoft reports the fix is available and, because 365 Copilot is a cloud service, the mitigation is applied server-side by Microsoft with no customer action required to receive it - confirm your tenant is current via the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42895. No exact customer-installable version number is published since the service is versionless. As compensating measures while validating coverage, restrict and monitor Copilot usage through Microsoft 365 admin controls (limit which users and connected data sources Copilot can act on, and review Copilot interaction/audit logs for anomalous command-like inputs); the trade-off is reduced Copilot functionality and availability for end users. Given the integrity-only impact, also validate downstream actions or content that Copilot generates or modifies in sensitive workflows rather than trusting them implicitly.
More in 365 Copilot
View allCVE-2025-32711 is an AI command injection vulnerability in Microsoft 365 Copilot that enables unauthenticated network-ba
Microsoft Office app Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.6), this vulnerability is remo
M365 Copilot has an input validation vulnerability allowing unauthorized attackers to extract sensitive information thro
Privilege elevation in Microsoft 365 Copilot's Business Chat is possible when an attacker abuses an open redirect (CWE-6
Local code execution in Microsoft Office is possible via a heap-based buffer overflow that an unauthorized attacker can
Local code execution in Microsoft Office is possible through a heap-based buffer overflow that an unauthorized attacker
Local code execution in Microsoft Office via a heap-based buffer overflow allows an unauthorized attacker to run arbitra
Local code execution in Microsoft Office via a heap-based buffer overflow that lets an unauthorized attacker run arbitra
M365 Copilot is vulnerable to command injection that enables unauthenticated remote attackers to extract sensitive infor
Out-of-bounds read (buffer over-read) in Microsoft Office exposes sensitive memory contents to a local attacker who can
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today