CVE-2026-42893
HighSummary
M365 Copilot has improper neutralization of special elements used in commands, leading to a 'command injection' vulnerability. This allows an unauthorized attacker to perform tampering over a network.
Risk Assessment
The organization may be exposed to unauthorized changes in the system, potentially leading to data loss or system integrity breaches.
Recommendation
It is recommended to update M365 Copilot to the latest version and implement additional security measures to minimize the risk of 'command injection' attacks.
Other vulnerabilities in M365 Copilot
See all- CVE-2026-50517Critical
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.
- CVE-2026-41106Critical
An open redirect vulnerability in M365 Copilot allows an unauthorized attacker to redirect users to a malicious site, potentially leading to privilege escalation over a network.
- CVE-2026-54130Critical
Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network.
- CVE-2026-42824Medium
A command injection vulnerability in M365 Copilot allows an unauthorized attacker to disclose information over a network.
- CVE-2026-42827Medium
In M365 Copilot, a command injection vulnerability exists due to improper neutralization of special elements used in a command. An unauthorized attacker can disclose information over a network.
Original NVD description (English source)
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to perform tampering over a network.