Veille CVE

Recherche « Microsoft 365 Copilot »

12 CVE

Critique 5 Élevée 7 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Microsoft 365 Copilot » ✕
  1. CVE-2026-85887 7.7 Élevée

    Microsoft 365 Copilot

    Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network.

  2. CVE-2026-85885 8.8 Élevée

    Microsoft 365 Copilot

    Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.

  3. CVE-2026-78501 8.6 Élevée

    Microsoft 365 Copilot's Business Chat · Microsoft 365 copilot chat

    Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.

  4. CVE-2026-50517 9.9 Critique

    Microsoft 365 Copilot

    Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.

  5. CVE-2026-59864 9.3 Critique

    microsoft kiota

    Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota plugin add` and `kiota plugin generate` (with `-t APIPlugin`) emitted attacker-controlled static_template.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin manifests without path validation, allowing ../, absolute, rooted, UNC, Windows drive, or URI paths in response_semantics.static_template.file to cause path traversal or out-of-package file inclusion when the generated plugin was deployed. This issue is fixed in version 1.29.1 and 1.32.5.

  6. CVE-2026-58617 9.8 Critique

    Microsoft 365 Copilot for iOS · Microsoft 365 copilot

    Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network.

  7. CVE-2026-50387 7.8 Élevée

    Microsoft Office 365 for Mac · Microsoft Office for Android · Microsoft Office LTSC for Mac 2021 · Microsoft Office LTSC for Mac 2024

    Stack-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges locally.

  8. CVE-2026-48561 9.6 Critique

    Microsoft Edge Copilot for Android · Microsoft Edge Copilot for IOS · Microsoft 365 copilot

    Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute code over a network.

  9. CVE-2026-41106 9.3 Critique

    Microsoft 365 Copilot

    Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.

  10. CVE-2026-47645 8.8 Élevée

    Microsoft 365 Copilot

    Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a network.

  11. CVE-2026-42895 7.5 Élevée

    Microsoft 365 Copilot

    Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.

  12. CVE-2026-54130 7.5 Élevée

    Microsoft 365 Copilot

    Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network.