CVE-2026-48561

CriticalCVSS 9.6

Published: 14/07/2026(UTC)Updated: 26/07/2026(UTC)Translated: 27/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.76%

52th percentile - higher than 52% of all known CVEs

Summary

Command injection vulnerability in Copilot Chat within Microsoft Edge. An unauthorized attacker can remotely execute code on the victim's device.

Risk Assessment

An attacker could take control of the user's system, installing malware or stealing data.

Recommendation

Update Microsoft Edge to the latest version that includes a fix for this vulnerability.

Original NVD description (English source)

Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute code over a network.