OCTOBER 12, 2026
Live Feed
Back to database
Case File

CVE-2026-78501

HIGH · CVSS 7.4 EPSS 0.48%

Source: NVD + CISA KEV + EPSS · Published 2026-09-17 · Last synced 2026-10-12

CyberRota Analysis

AI-Generated

Microsoft 365 Copilot's Business Chat is vulnerable to command injection due to improper handling of special elements, enabling unauthorized attackers to potentially disclose sensitive information over the network. Organizations utilizing Microsoft 365 Copilot should prioritize patching this vulnerability to mitigate the risk of data exposure. This issue is particularly critical for businesses that rely on the platform for sensitive communications and data management.

CVE
CVE-2026-78501
Severity
HIGH
CVSS
7.4
EPSS
0.48%
Microsoft

Original NVD Description

Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.

Related CVEs

Other vulnerabilities affecting the same vendor(s)

CVE-2026-106420 MEDIUM CVE-2026-106376 MEDIUM CVE-2026-106373 HIGH CVE-2026-106284 MEDIUM CVE-2026-106272 MEDIUM CVE-2026-106258 MEDIUM