7.5 HighCWE-77
CVE-2026-21520
Microsoft Copilot Studio vulnerability
MicrosoftMicrosoft Copilot Studio
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
1.5%probability of exploitation in the next 30 days
Higher than 75% of scored CVEs
SeverityCVSS
7.5High
Description NVD
Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector
Coverage 1 article · 1 outlet
- Salesforce and Microsoft fix prompt inject bugs exposing CRM dataDark Reading · first in our coverage