Product:
M365 Copilot
Summary
AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network. This vulnerability poses a significant risk as it can lead to unauthorized access to sensitive data. Attackers can exploit this flaw without needing elevated privileges, making it a critical concern for users.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.1 | CVE-2026-26133 |
Exploitation
To exploit this vulnerability, an attacker must interact with the M365 Copilot in a way that triggers the AI command injection. This typically involves sending specially crafted input that the system processes, allowing the attacker to extract sensitive information from the network. The low attack complexity means that even users with minimal technical skills could potentially exploit this flaw if they understand how to manipulate the input.
Affected Products
- M365 Copilot: AI command injection vulnerability allowing unauthorized information disclosure.
Mitigation
To mitigate this vulnerability, users should ensure that they are using the latest version of M365 Copilot and apply any security updates provided by Microsoft. Additionally, organizations should implement strict access controls and monitor network traffic for any suspicious activity that may indicate exploitation attempts.