CVE-2026-55946: Microsoft Copilot Information Disclosure Vulnerability
Published Sep 17, 2026
·Updated
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
Other sources
Microsoft Copilot Information Disclosure Vulnerability
— Microsoft
Affected Software
2 affected components
Microsoft Copilot
Microsoft Copilot
Event History
Sep 17, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·02:00 PM
Description
CVE Published
via MITRE·10:55 PM
Data Sourced
via MITRE·10:55 PM
DescriptionSeverity
Frequently Asked Questions
1
Does exploitation require an authenticated account or user interaction?
The CVSS vector indicates no privileges are required, but user interaction is required. Exploitation also has high attack complexity.
2
What is the expected impact if exploitation succeeds?
The reported impact is high confidentiality impact, meaning information may be disclosed. No integrity or availability impact is indicated.