CVE-2026-85887

M365 Copilot has improper neutralization of special elements used in commands, leading to a 'command injection' vulnerability. This allows an unauthorized attacker to perform tampering over a network.

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.

Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.

An open redirect vulnerability in M365 Copilot allows an unauthorized attacker to redirect users to a malicious site, potentially leading to privilege escalation over a network.

Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network.

A command injection vulnerability in M365 Copilot allows an unauthorized attacker to disclose information over a network.

In M365 Copilot, a command injection vulnerability exists due to improper neutralization of special elements used in a command. An unauthorized attacker can disclose information over a network.