Missing Authentication in M365 Copilot Exposes Sensitive Data

Publication date: 2026-06-18

Last updated on: 2026-06-25

Assigner: Microsoft Corporation

Description

Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-18

Last Modified

2026-06-25

Generated

2026-07-09

AI Q&A

2026-06-19

EPSS Evaluated

2026-07-08

NVD

CVE-2026-54130

EUVD

EUVD-2026-37946

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	365_copilot	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability involves missing authentication for a critical function in Microsoft 365 Copilot. Because of this lack of authentication, an unauthorized attacker can access and disclose sensitive information over a network.

Impact Analysis

The vulnerability can have severe impacts including unauthorized disclosure of sensitive information. Given the high CVSS score of 9.8, it indicates that an attacker can remotely exploit this issue without any privileges or user interaction, potentially leading to complete confidentiality, integrity, and availability compromise.

Hi! I’m here to help you understand CVE-2026-54130. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70