Loading story…
Microsoft disclosed CVE-2026-48561, a critical remote code execution flaw in Microsoft Copilot caused by CWE-77 command injection. The vulnerability carries a CVSS 3.1 score of 9.6 and can be exploited remotely without privileges, though user interaction is required. Microsoft said the issue was not publicly disclosed and not exploited at the time of publication, and rated exploitation as less likely.
According to the advisory, an attacker could host a malicious website that causes Microsoft Edge for Android to automatically send crafted prompts to Copilot, potentially triggering unintended actions such as accessing or modifying data. Microsoft also warned that successful exploitation could involve a scope change, including traversal from a low-privilege Hyper-V guest to code execution on the Hyper-V host. A security update was available when the advisory was published, and Microsoft credited Ofek Levin of Enclave with reporting the bug.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
At the time of the advisory's publication, Microsoft said an official fix was available for the Microsoft Copilot remote code execution vulnerability CVE-2026-48561.
Microsoft disclosed CVE-2026-48561, a critical Microsoft Copilot remote code execution vulnerability caused by CWE-77 command injection, with a CVSS 3.1 score of 9.6. Microsoft said the flaw was not publicly disclosed or exploited at the time of publication and credited Ofek Levin of Enclave for reporting it.
MITRE published the CWE-77 entry for improper neutralization of special elements used in a command, defining the command injection weakness category referenced by later advisories.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed `CVE-2026-50517`, a critical remote code execution flaw in Microsoft 365 Copilot caused by deserialization of untrusted data (`CWE-502`). The vulnerability allows an authenticated attacker with low privileges to execute code over the network without user interaction, and carries a `CVSS 3.1` score of `9.9` with the vector `AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`, indicating high impact across confidentiality, integrity, and availability with changed scope. The issue affects the hosted Microsoft 365 Copilot service, and Microsoft remediated it on the service side rather than through a customer-installed patch. Reporting indicated all versions of M365 Copilot were affected, while no active exploitation had been publicly reported at the time of disclosure. Organizations were advised to confirm tenant coverage, review Copilot permissions and access, enable auditing, and monitor for unusual Copilot-related activity.
Jul 24, 2026
Researchers reported that vulnerabilities in Microsoft 365 Copilot and Consumer Copilot allowed attackers to turn prompt injection into data exfiltration, memory poisoning, and persistent compromise. Microsoft assigned `CVE-2026-24299` to the main issue set and rolled out fixes across late 2025 and early 2026, while a related Microsoft Excel flaw, `CVE-2026-26144`, showed how a conventional application bug could be chained with Copilot Agent mode to silently extract spreadsheet data. In the Copilot attacks, malicious content abused HTML preview rendering to leak sensitive information through external requests, first with CSS background images and later with `@font-face`, and researchers said users could be coerced into triggering the preview during normal interaction, creating a near zero-click exfiltration path. The research also showed that Copilot’s memory features could be poisoned to add or delete stored facts and implant persistent instructions that altered future sessions, enabling a backdoor dubbed **SpAIware** that continued leaking secrets over time. Similar issues were described in consumer Copilot, including durable-memory manipulation and browser-navigation exfiltration through Edge-integrated tooling. The findings underscore a broader security shift: AI assistants can collapse trust boundaries inside host applications, raising the impact of older flaws and forcing defenders to reassess assistant permissions, restrict outbound network access from AI-enabled apps, and separately monitor AI-initiated network activity.
Jun 29, 2026
Microsoft disclosed a set of security flaws affecting cloud and AI services, including **Microsoft 365 Copilot**, **Microsoft Copilot**, **Microsoft 365 Copilot BizChat**, **Azure DevOps**, **Azure Cloud Shell**, **Azure Data Factory**, **Microsoft Bing**, and **Microsoft Bing Images**. The issues span **information disclosure**, **elevation of privilege**, **tampering**, and **remote code execution**, with published identifiers including `CVE-2026-24299`, `CVE-2026-26136`, `CVE-2026-26137`, `CVE-2026-23658`, `CVE-2026-32169`, `CVE-2026-23659`, `CVE-2026-26120`, and `CVE-2026-32191`. Germany's dCERT separately highlighted multiple vulnerabilities in **Microsoft 365 Copilot**, underscoring enterprise concern around AI-assisted productivity platforms. The most severe issue in the group is **`CVE-2026-32191`**, a **critical remote code execution** flaw in **Microsoft Bing Images**. Public reporting tied the bug to **OS command injection** caused by improper neutralization of special elements in a command, potentially allowing an unauthenticated attacker to execute code over a network. Additional Bing exposure was tracked as **`CVE-2026-26120`**, a tampering vulnerability, while the Copilot-related flaws included both **information disclosure** and **privilege escalation**, indicating risk to data confidentiality and tenant-level access boundaries across Microsoft's hosted services.
Jul 24, 2026