CVE-2026-428246.5MediumCWE-77
Microsoft 365 Copilot vulnerability
Microsoft · Microsoft 365 Copilot
Not in CISA KEVVendor fix available
7.6%probability of exploitation in the next 30 days
94th percentile
050100
Higher than 94% of scored CVEs
6.5MediumCVSS 3.1
LowMediumHighCrit.
DescriptionNVD
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.
Coverage1 article · 1 outlet
First in our coverage: Dark Reading, 15 Jun.
- Attackers hijack Microsoft Copilot to leak data CVE-2026-42824Dark Reading · first in our coverage
New articles also arrive in the RSS feed.