DeutschShown in its original language — a full translation is planned for a future version.
Microsoft 365 Copilot: Mehrere Schwachstellen
view advisory published 2026-06-21
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Microsoft 365 Copilot ausnutzen, um seine Privilegien zu erhöhen, Befehlsinjektionen durchzuführen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.
01
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-47645US | high8.8 | — | ||
Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-42895US | high7.5 | — | ||
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network. | ||||
| CVE-2026-54130US | high7.5OT elevated | — | ||
Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network. | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan