CVE Catalog
CVE-2026-24301
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk1.63%
74th percentile - higher than 74% of all known CVEs
Summary
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
Risk Assessment
An attacker can execute malicious commands, potentially leading to disclosure of sensitive data.
Recommendation
Apply patches provided by Microsoft for Copilot.
Original NVD description (English source)
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.