CVE-2026-26164 - M365 Copilot Information Disclosure Vulnerability

Back Back to CVE browser

HIGH

M365 Copilot Information Disclosure Vulnerability

Published May 7, 2026

7.5

HIGH

CVSS 3.1

EPSS 1.03%

Description

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Affected products

Vendor Microsoft Product Microsoft 365 Copilot's Business Chat Default
n/a

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microsoft

Microsoft 365 Copilot's Business Chat

n/a

Version	Status	Constraints

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-74

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26164
vendor-advisorypatchVendor Advisory

Link	Providers	Tags
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26164		vendor-advisorypatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner microsoft

Published May 7, 2026

Updated Aug 10, 2026

Reserved Feb 11, 2026

Link CVE-2026-26164

CISA Vulnrichment

Updated May 8, 2026

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2026-26164

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-26164