CVE Catalog
CVE-2026-50517
CriticalCVSS 9.9Exploitation Probability (EPSS)
Elevated risk1.25%
66th percentile - higher than 66% of all known CVEs
Summary
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.
Risk Assessment
An authorized attacker can remotely execute arbitrary code on the M365 Copilot server, potentially leading to data theft, privilege escalation, or full service compromise.
Recommendation
Apply the security update provided by Microsoft for M365 Copilot and monitor the environment for unusual activity.
Original NVD description (English source)
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.