CVE-2026-42895 — Vulnerability intelligence
microsoft — 365 copilot
Published:
- CVSS
- 6.5
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.