CVE-2026-24301: Microsoft Copilot Information Disclosure Vulnerability
Published Aug 18, 2026
·Updated
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
Other sources
Microsoft Copilot Information Disclosure Vulnerability
— Microsoft
Affected Software
1 affected component
Microsoft Copilot Web
Event History
Aug 18, 2026
CVE Published
via MITRE·01:19 PM
Data Sourced
via MITRE·01:19 PM
DescriptionSeverity
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·02:00 PM
Description
Frequently Asked Questions
1
What access does an attacker need to exploit this?
The vector is network-based and requires no attacker privileges, but exploitation requires user interaction. The available data does not specify what interaction is needed or whether a default configuration is affected.
2
What can be used to determine exposure or compromise?
The provided information identifies Microsoft Copilot Web as the affected software. It does not provide affected versions, fixed versions, mitigations, or indicators for determining whether an environment has been exploited.