PT-2026-26352 · Microsoft · M365 Copilot

Johann Rehberger + 1 · Publicado 2026-03-19 · Atualizado 2026-06-04 · CVE-2026-24299

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions M365 Copilot (affected versions not specified)

Description An improper neutralization of special elements used in a command ('command injection') exists in M365 Copilot. This allows an unauthorized attacker to disclose information over a network.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2026-24299

Produtos afetados

M365 Copilot

Referências · 14

• https://twitter.com/wunderwuzzi23/status/2051413507929952497 · Publicação no Twitter
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24299 · Aviso do Fabricante
• https://twitter.com/ai_security_10x/status/2051764044898664859 · Publicação no Twitter
• https://twitter.com/warthogtk/status/2051762188189139225 · Publicação no Twitter
• https://twitter.com/ai_security_10x/status/2051354130153943316 · Publicação no Twitter
• https://twitter.com/aiseceng/status/2054094457088139438 · Publicação no Twitter
• https://twitter.com/ai_security_10x/status/2051453089711104430 · Publicação no Twitter
• https://twitter.com/jelizor/status/2062443527343161784 · Publicação no Twitter
• https://reddit.com/r/SecOpsDaily/comments/1t3iqa9/copirate_365_at_def_con_plundering_in_the_depths · Publicação no Reddit
• https://twitter.com/ai_security_10x/status/2053181274001736174 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2035627045779059191 · Publicação no Twitter
• https://twitter.com/ksg93rd/status/2052016208489202016 · Publicação no Twitter
• https://twitter.com/ai_security_10x/status/2053420118387130761 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-24299 · Nota de Segurança