Skip to content
Advisories.
microsoftCVE-2026-85887

Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network.

High7.7CVE-2026-85887 · Published Sep 18, 2026

Source advisory

Affected versions

PackageAffectedFixed in
Microsoft 365 Copilot
Vendor
all versionsNo fix yet
Details and references

Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network.

CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Severity from
no source yet
Weakness
CWE-732

More microsoft advisories

All
DateAdvisory
Sep 18Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-62874Critical10.0no fix yet
Sep 18Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-69843Critical10.0no fix yet
Sep 18Improper neutralization of input during web page generation ('cross-site scripting') in Azure Portal allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-83946High8.2no fix yet
Sep 18Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network.
CVE-2026-85878Critical9.9no fix yet
Sep 17Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.
CVE-2026-85885Critical9.9no fix yet
Sep 17Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-85889Critical10.0no fix yet

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.