Veille CVE

Semaine du 14 septembre au 20 septembre 2026

4 CVE

Critique 0 Élevée 4 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Microsoft microsoft 365 » ✕
  1. CVE-2026-85887 7.7 Élevée

    Microsoft 365 Copilot

    Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network.

  2. CVE-2026-85885 8.8 Élevée

    Microsoft 365 Copilot

    Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.

  3. CVE-2026-78501 8.6 Élevée

    Microsoft 365 Copilot's Business Chat · Microsoft 365 copilot chat

    Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.

  4. CVE-2026-58201 8.7 Élevée

    merill lokka

    Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled path value to the management.azure.com base URL. A specially crafted path can alter URL authority parsing and cause an Azure Resource Manager bearer token to be sent to an unintended host. This issue is fixed in version 2.1.2.