Microsoft 365 Copilot Business Chat command injection

Summaryinfo

A vulnerability was found in Microsoft 365 Copilot and classified as problematic. This impacts an unknown function of the component Business Chat. Such manipulation leads to command injection. This vulnerability is documented as CVE-2026-78501. The attack can be executed remotely. There is not any exploit available. This product is a managed service. It is not possible for users to maintain vulnerability countermeasures themselves.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Microsoft 365 Copilot (the affected version is unknown). Affected by this issue is an unknown code of the component Business Chat. The manipulation with an unknown input leads to a command injection vulnerability. Using CWE to declare the problem leads to CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. Impacted is confidentiality. CVE summarizes:

Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.

The advisory is available at msrc.microsoft.com. This vulnerability is handled as CVE-2026-78501 since 08/24/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 09/18/2026). This vulnerability is assigned to T1202 by the MITRE ATT&CK project.

This product is available as a managed service. Users are not able to maintain vulnerability countermeasures themselves.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Microsoft

Name

• 365 Copilot

License

• commercial

Managed Service

• yes

Website

• Vendor: https://www.microsoft.com/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion