MicrosoftCVE-2026-78501

Microsoft 365 Copilot's Business Chat: command injection

High7.4CVE-2026-78501 · Published Sep 17, 2026 · updated Sep 18, 2026

Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.

Microsoft advisory

Affected versions

Package	Affected	Fixed in
Microsoft 365 Copilot's Business Chat Product	all versions	No fix yet

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-77, CWE-923

More Microsoft advisories

All Microsoft

Date	Advisory	Severity	Fixed in
Sep 17	Microsoft 365 Copilot: command injection Critical9.9Sep 17 CVE-2026-85885No fix yet	Critical9.9	No fix yet
Sep 17	Microsoft Azure AI Foundry: missing authentication Critical10.0Sep 17 CVE-2026-85889No fix yet	Critical10.0	No fix yet
Sep 17	Microsoft Azure AI Foundry: server-side request forgery High7.5Sep 17 CVE-2026-85917No fix yet	High7.5	No fix yet
Sep 17	Microsoft Azure Cosmos DB: privilege escalation Critical9.6Sep 17 CVE-2026-87701No fix yet	Critical9.6	No fix yet
Sep 17	Microsoft Azure Logic Apps: improper access control Critical10.0Sep 17 CVE-2026-83944No fix yet	Critical10.0	No fix yet
Sep 17	Microsoft Dataverse: authentication bypass Critical9.0Sep 17 CVE-2026-77903No fix yet	Critical9.0	No fix yet

Affected versions

More Microsoft advisories

Critical advisories by email