CVE-2026-42895
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A vulnerability in Microsoft Copilot allows an unauthorized attacker to perform command injection over a network. The issue stems from improper neutralization of special elements used in a command.
Risk Assessment
An attacker can tamper with Copilot's operation, potentially leading to unauthorized changes in the system or access to sensitive data.
Recommendation
Apply the security update provided by Microsoft for the Copilot component immediately.
Other vulnerabilities in Microsoft Copilot
See all- CVE-2026-41090Critical
Command injection vulnerability in Microsoft Copilot. An unauthorized attacker can remotely tamper with the application over a network.
- CVE-2026-69855High
Server-side request forgery (SSRF) in Microsoft Copilot in Azure allows an authorized attacker to disclose information over a network.
- CVE-2026-24301High
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
- CVE-2026-45497High
Microsoft Copilot is vulnerable to command injection due to improper neutralization of special elements used in commands. This allows an authorized attacker to execute code over a network.
Original NVD description (English source)
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.