CVE-2026-45497: Microsoft M365 Copilot Remote Code Execution Vulnerability
Published Jun 4, 2026
·Updated
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an authorized attacker to execute code over a network.
Other sources
Microsoft M365 Copilot Remote Code Execution Vulnerability
— Microsoft
Affected Software
3 affected components
Microsoft Microsoft 365 Copilot
Microsoft 365 Copilot
Microsoft Copilot
Event History
Jun 4, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·02:00 PM
Description
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
DescriptionSeverity
Data Sourced
via NVD·11:17 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-45497?
CVE-2026-45497 has a high severity score of 8.8.
2
What type of vulnerability is CVE-2026-45497?
CVE-2026-45497 is classified as a Command Injection vulnerability.
3
How can I mitigate CVE-2026-45497?
Mitigation for CVE-2026-45497 includes updating Microsoft 365 Copilot to the latest version provided by Microsoft.
4
Who is affected by CVE-2026-45497?
CVE-2026-45497 affects users of Microsoft 365 Copilot who have authorized access.
5
What can an attacker do with CVE-2026-45497?
An attacker can execute arbitrary code over a network due to the improper neutralization of commands in CVE-2026-45497.