CVE Catalog
CVE-2026-41090
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk0.42%
34th percentile - higher than 34% of all known CVEs
Summary
Command injection vulnerability in Microsoft Copilot. An unauthorized attacker can remotely tamper with the application over a network.
Risk Assessment
An attacker can alter Copilot's behavior, potentially leading to unauthorized actions or data leakage.
Recommendation
Apply the security update from Microsoft for Microsoft Copilot as soon as it becomes available.
Original NVD description (English source)
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.