CVE Catalog
CVE-2026-42824
MediumCVSS 6.5Exploitation Probability (EPSS)
Very high risk7.64%
94th percentile - higher than 94% of all known CVEs
Summary
A command injection vulnerability in M365 Copilot allows an unauthorized attacker to disclose information over a network.
Risk Assessment
The risk involves potential leakage of sensitive information by an unauthorized attacker.
Recommendation
Apply security patches from Microsoft and monitor the network for suspicious activity.
Original NVD description (English source)
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.