AIR-2026-0249 · Two Copilot command-injection CVEs published 2026-09-17: privilege elevation in M365 Copilot (CVE-2026-85885, CVSS 9.9) and information disclosure in Microsoft Copilot (CVE-2026-55946)

Two Copilot command-injection CVEs published 2026-09-17: privilege elevation in M365 Copilot (CVE-2026-85885, CVSS 9.9) and information disclosure in Microsoft Copilot (CVE-2026-55946)

AIR-2026-0249 AIR record · 2026-09-microsoft-copilot-command-injection-cves

From the supporting source

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.msrc.microsoft.com

The record

Disclosed

2026-09-17

Vendor

Microsoft

Product

Microsoft 365 Copilot

Risk domain

Access control and permissions › Privilege escalation

Also touches

Data exfiltration channels, Sensitive data exposure

System type

Generative model

Who acted

AI was the target — vendor-classified command injection in Copilot; no model decision documented

Attack surface

Enterprise assistant

Autonomy level

Assistant

Initial vector

Command injection

Impact type

Privilege escalation, Scope violation, Information disclosure, Data exfiltration

Confidence

High

Submitted by

EAI Internal

Crosswalk

OWASP Agentic Top 10 (2026): ASI03 – Identity and Privilege Abuse
MITRE ATLAS: AML.T0055 – Unsecured Credentials
NIST AI RMF: GOVERN 6.1
EU AI Act: Article 13
ISO/IEC: TR 24028; 42001; 23894
AIUC-1: B. Security
Scope: tool misuse
Mitigation: Apply least-privilege principle; Regular policy audits.
Taxonomy: Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery

Blast radius

Microsoft 365 Copilot (service-side; no product version listed)

Capability abused

command_constructionretrieval

Defense & remediation

Guardrail kinds

Unknown

Guardrail outcome

Silent

Fix shipped

server-side (Microsoft, September 2026)

Curator notes

Same-day sibling MSRC advisories with identical CWE-77 boilerplate, fused 2026-09-21 into one record on the precedent of AIR-2026-0105 (two May 2026 M365 Copilot command-injection CVEs recorded together). CVE-2026-85885: CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), authorized attacker elevates privileges over a network in M365 Copilot. CVE-2026-55946: CVSS 6.1 base (AV:N/AC:H/PR:N/UI:R), MSRC labels it Critical; unauthorized attacker discloses information over a network in Microsoft Copilot. Both published 2026-09-17, marked not exploited and not publicly disclosed, patched server-side. No researcher write-up or attack chain located; the verified quote is the official CVE description, which is the same boilerplate as AIR-2026-0105 and CVE-2026-33111, so it is not distinctive evidence on its own. Distinct CVEs from the May pair; the recurring class is itself notable.

Cite as

Enkrypt AI. "Two Copilot command-injection CVEs published 2026-09-17: privilege elevation in M365 Copilot (CVE-2026-85885, CVSS 9.9) and information disclosure in Microsoft Copilot (CVE-2026-55946)". AIR, AIR-2026-0249. https://agentincident.vercel.app/i/AIR-2026-0249/ (accessed 2026-10-19).