PT-2026-26352 · Microsoft · M365 Copilot

Johann Rehberger + 1 · Published 2026-03-19 · Updated 2026-06-04 · CVE-2026-24299

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions M365 Copilot (affected versions not specified)

Description An improper neutralization of special elements used in a command ('command injection') exists in M365 Copilot. This allows an unauthorized attacker to disclose information over a network.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-24299

Affected Products

M365 Copilot

References · 14

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24299 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24299 · Security Note
• https://twitter.com/ai_security_10x/status/2051764044898664859 · Twitter Post
• https://twitter.com/ai_security_10x/status/2053420118387130761 · Twitter Post
• https://twitter.com/ai_security_10x/status/2053181274001736174 · Twitter Post
• https://twitter.com/jelizor/status/2062443527343161784 · Twitter Post
• https://reddit.com/r/SecOpsDaily/comments/1t3iqa9/copirate_365_at_def_con_plundering_in_the_depths · Reddit Post
• https://twitter.com/aiseceng/status/2054094457088139438 · Twitter Post
• https://twitter.com/wunderwuzzi23/status/2051413507929952497 · Twitter Post
• https://twitter.com/ai_security_10x/status/2051354130153943316 · Twitter Post
• https://twitter.com/warthogtk/status/2051762188189139225 · Twitter Post
• https://twitter.com/ksg93rd/status/2052016208489202016 · Twitter Post
• https://twitter.com/ai_security_10x/status/2051453089711104430 · Twitter Post
• https://twitter.com/CVEnew/status/2035627045779059191 · Twitter Post