CVE-2026-50517
CriticalCVSS 9.9Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.
Risk Assessment
An authorized attacker can remotely execute arbitrary code on the M365 Copilot server, potentially leading to data theft, privilege escalation, or full service compromise.
Recommendation
Apply the security update provided by Microsoft for M365 Copilot and monitor the environment for unusual activity.
Other vulnerabilities in M365 Copilot
See all- CVE-2026-42893High
M365 Copilot has improper neutralization of special elements used in commands, leading to a 'command injection' vulnerability. This allows an unauthorized attacker to perform tampering over a network.
- CVE-2026-41106Critical
An open redirect vulnerability in M365 Copilot allows an unauthorized attacker to redirect users to a malicious site, potentially leading to privilege escalation over a network.
- CVE-2026-54130Critical
Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network.
- CVE-2026-42824Medium
A command injection vulnerability in M365 Copilot allows an unauthorized attacker to disclose information over a network.
- CVE-2026-42827Medium
In M365 Copilot, a command injection vulnerability exists due to improper neutralization of special elements used in a command. An unauthorized attacker can disclose information over a network.
Original NVD description (English source)
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.