Command Injection Vulnerability in Microsoft 365 Copilot's Business Chat
CVE-2026-78501

7.4HIGH

Key Information:

Vendor

Microsoft
Status
Microsoft 365 Copilot's Business Chat
Vendor
CVE Published:
17 September 2026

What is CVE-2026-78501?

A command injection vulnerability in Microsoft 365 Copilot's Business Chat allows unauthorized attackers to manipulate command execution, potentially leading to sensitive information disclosure over the network. This flaw arises from improper neutralization of special elements in user inputs, which could be exploited if not mitigated. Users are advised to apply security patches and updates to safeguard against potential exploitation.

Affected Version(s)

Microsoft 365 Copilot's Business Chat -

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.