Disclosed vulnerability
Two M365 Copilot command-injection information-disclosure CVEs patched server-side
AIR-2026-0105 AIR record · 2026-05-microsoft-m365-copilot-command-injection-cves
From the supporting source
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.tenable.com
The record
Disclosed
2026-05-07
Vendor
Microsoft
Product
Microsoft 365 Copilot
Risk domain
Privacy › Data exfiltration channels
System type
Generative model
Who acted
Agent acted — Copilot retrieved and rendered data out under command injection
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Prompt injection unspecified
Impact type
Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Microsoft 365 Copilot tenants; remediated at the service layer with no customer action
Capability abused
Defense & remediation
Recorded defense
unknown
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
cloud-side remediation by Microsoft, published 2026-05-07
Taxonomy & references
Curator notes
No researcher write-up or marketing name was found for these two; the only sources located are the CVE records (CVSS v3 7.5 each, published 2026-05-07). A third sibling CVE from the same date, CVE-2026-33111, has the identical description but names 'Copilot Chat (Microsoft Edge)' and is more of a browser-agent surface, so it is not recorded here. Microsoft's own advisory pages render their text dynamically and are not quoted directly. Attribution and exact attack chain are UNKNOWN.
Supporting sources
Cite as
Enkrypt AI. "Two M365 Copilot command-injection information-disclosure CVEs patched server-side". AIR, AIR-2026-0105. https://agentincident.vercel.app/i/AIR-2026-0105/ (accessed 2026-10-19).