CVE-2026-24301
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk91th percentile - higher than 91% of all known CVEs
Summary
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
Risk Assessment
An attacker can execute malicious commands, potentially leading to disclosure of sensitive data.
Recommendation
Apply patches provided by Microsoft for Copilot.
Other vulnerabilities in Microsoft Copilot
See all- CVE-2026-41090Critical
Command injection vulnerability in Microsoft Copilot. An unauthorized attacker can remotely tamper with the application over a network.
- CVE-2026-55946Medium
Ai command injection in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
- CVE-2026-69855High
Server-side request forgery (SSRF) in Microsoft Copilot in Azure allows an authorized attacker to disclose information over a network.
- CVE-2026-42895Medium
A vulnerability in Microsoft Copilot allows an unauthorized attacker to perform command injection over a network. The issue stems from improper neutralization of special elements used in a command.
- CVE-2026-45497High
Microsoft Copilot is vulnerable to command injection due to improper neutralization of special elements used in commands. This allows an authorized attacker to execute code over a network.
Original NVD description (English source)
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS