CVE-2026-85885
CriticalCVSS 9.9Summary
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.
Risk Assessment
An authenticated attacker could inject commands and elevate privileges, potentially resulting in unauthorized actions within the M365 environment.
Recommendation
Update M365 Copilot to the patched version and review user permissions and integrations.
Other vulnerabilities in M365 Copilot
See all- CVE-2026-42893High
M365 Copilot has improper neutralization of special elements used in commands, leading to a 'command injection' vulnerability. This allows an unauthorized attacker to perform tampering over a network.
- CVE-2026-50517Critical
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.
- CVE-2026-41106Critical
An open redirect vulnerability in M365 Copilot allows an unauthorized attacker to redirect users to a malicious site, potentially leading to privilege escalation over a network.
- CVE-2026-54130Critical
Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network.
- CVE-2026-42824Medium
A command injection vulnerability in M365 Copilot allows an unauthorized attacker to disclose information over a network.
- CVE-2026-42827Medium
In M365 Copilot, a command injection vulnerability exists due to improper neutralization of special elements used in a command. An unauthorized attacker can disclose information over a network.
Original NVD description (English source)
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.