CVE-2026-42827
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
In M365 Copilot, a command injection vulnerability exists due to improper neutralization of special elements used in a command. An unauthorized attacker can disclose information over a network.
Risk Assessment
An attacker can remotely execute arbitrary system commands, leading to disclosure of sensitive data and potential system compromise.
Recommendation
Apply the patch provided by the M365 Copilot vendor and strengthen input validation.
Other vulnerabilities in M365 Copilot
See all- CVE-2026-42893High
M365 Copilot has improper neutralization of special elements used in commands, leading to a 'command injection' vulnerability. This allows an unauthorized attacker to perform tampering over a network.
- CVE-2026-50517Critical
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.
- CVE-2026-41106Critical
An open redirect vulnerability in M365 Copilot allows an unauthorized attacker to redirect users to a malicious site, potentially leading to privilege escalation over a network.
- CVE-2026-54130Critical
Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network.
- CVE-2026-42824Medium
A command injection vulnerability in M365 Copilot allows an unauthorized attacker to disclose information over a network.
Original NVD description (English source)
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.