Microsoft 365 Copilot vulnerabilities

14 vulnerabilities

Known vulnerabilities in Microsoft 365 Copilot, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

9.3CVE-2025-32711microsoft365_copilot+1
EPSS score
8.03%
Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.9.8CVE-2026-54130microsoft365_copilot+1
EPSS score
1.08%
Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network.9.3CVE-2026-41106microsoft365_copilot+1
EPSS score
0.72%
Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.8.8CVE-2026-47645microsoft365_copilot+1
EPSS score
0.76%
Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a network.7.5CVE-2026-42895microsoft365_copilot+1
EPSS score
0.71%
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.7.5CVE-2026-42827microsoft365_copilot+1
EPSS score
0.92%
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.7.5CVE-2026-42824microsoftcopilot+1
EPSS score
0.92%
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.5.3CVE-2026-24299microsoft365_copilot+1
EPSS score
0.66%
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.9.3CVE-2026-24307microsoft365_copilot+1
EPSS score
0.91%
Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network.8.8CVE-2026-45497microsoftcopilot+1
EPSS score
0.61%
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an authorized attacker to execute code over a network.9.9CVE-2026-50517microsoft365_copilot+1
EPSS score
1.69%
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.7.7CVE-2026-85887microsoft365_copilot+1
EPSS score
0.84%
Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network.9.9CVE-2026-85885microsoft365_copilot+1
EPSS score
0.72%
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.9.3CVE-2026-33102microsoft365_copilot+1
EPSS score
0.72%
Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.