CVE-2026-85885: Microsoft 365 Copilot Elevation of Privilege Vulnerability
Published Sep 17, 2026
·Updated
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.
Other sources
Microsoft 365 Copilot Elevation of Privilege Vulnerability
— Microsoft
Affected Software
2 affected components
Microsoft 365 Copilot
Microsoft M365 Copilot
Event History
Sep 17, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·02:00 PM
Affected Software
Updated
via Microsoft·02:00 PM
Description
CVE Published
via MITRE·10:55 PM
Data Sourced
via MITRE·10:55 PM
DescriptionSeverity