Command Injection in Microsoft Copilot

Publication date: 2026-06-19

Last updated on: 2026-06-26

Assigner: Microsoft Corporation

Description

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-19

Last Modified

2026-06-26

Generated

2026-07-11

AI Q&A

2026-06-20

EPSS Evaluated

2026-07-10

NVD

CVE-2026-42895

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	365_copilot	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is a command injection issue in Microsoft Copilot. It occurs because special elements used in commands are not properly neutralized, allowing an unauthorized attacker to execute tampering actions over a network.

Impact Analysis

An attacker exploiting this vulnerability can perform tampering over a network without authorization. This means they could potentially alter data or system behavior, leading to integrity issues.

Hi! I’m here to help you understand CVE-2026-42895. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70