CVE-2026-24307
Unknown
Unknown - Not Provided
Improper Input Validation in M365 Copilot Enables Data Disclosure
Publication date: 2026-01-22
Last updated on: 2026-02-12
Assigner: Microsoft Corporation
Description
Description
Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| microsoft | 365_copilot | * |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-1287 | The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves improper validation of a specified type of input in Microsoft 365 Copilot, which allows an unauthorized attacker to disclose information over a network.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of sensitive information over a network, potentially compromising confidentiality and leading to data breaches.
Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70