CVE-2026-78501

HighCVSS 8.6

Published: 17/09/2026(UTC)Updated: 14/10/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.54%

44th percentile - higher than 44% of all known CVEs

Summary

Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.

Risk Assessment

An attacker can inject malicious commands, potentially leading to disclosure of sensitive data.

Recommendation

It is recommended to update Microsoft 365 Copilot and apply the principle of least privilege.

Other vulnerabilities in Microsoft 365 Copilot

CVE-2026-58617High
An improper access control vulnerability in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network.

Original NVD description (English source)

Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS