CVE-2026-55946
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
Ai command injection in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
Risk Assessment
This may lead to unauthorized information disclosure, posing a threat to confidentiality.
Recommendation
Apply available updates or mitigations for Microsoft Copilot to reduce the risk.
Other vulnerabilities in Microsoft Copilot
See all- CVE-2026-24301High
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
- CVE-2026-41090Critical
Command injection vulnerability in Microsoft Copilot. An unauthorized attacker can remotely tamper with the application over a network.
- CVE-2026-69855High
Server-side request forgery (SSRF) in Microsoft Copilot in Azure allows an authorized attacker to disclose information over a network.
- CVE-2026-42895Medium
A vulnerability in Microsoft Copilot allows an unauthorized attacker to perform command injection over a network. The issue stems from improper neutralization of special elements used in a command.
- CVE-2026-45497High
Microsoft Copilot is vulnerable to command injection due to improper neutralization of special elements used in commands. This allows an authorized attacker to execute code over a network.
Original NVD description (English source)
Ai command injection in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS