CVE-2026-69855
HighCVSS 7.7Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
Server-side request forgery (SSRF) in Microsoft Copilot in Azure allows an authorized attacker to disclose information over a network.
Risk Assessment
An authorized attacker can exploit SSRF to access internal resources and disclose sensitive data, compromising confidentiality.
Recommendation
Apply patches provided by Microsoft for Microsoft Copilot in Azure and restrict network access to internal resources.
Other vulnerabilities in Microsoft Copilot
See all- CVE-2026-24301High
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
- CVE-2026-41090Critical
Command injection vulnerability in Microsoft Copilot. An unauthorized attacker can remotely tamper with the application over a network.
- CVE-2026-55946Medium
Ai command injection in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
- CVE-2026-42895Medium
A vulnerability in Microsoft Copilot allows an unauthorized attacker to perform command injection over a network. The issue stems from improper neutralization of special elements used in a command.
- CVE-2026-45497High
Microsoft Copilot is vulnerable to command injection due to improper neutralization of special elements used in commands. This allows an authorized attacker to execute code over a network.
Original NVD description (English source)
Server-side request forgery (ssrf) in Microsoft Copilot in Azure allows an authorized attacker to disclose information over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS