CVE-2024-43610: Microsoft Copilot Studio information disclosure
Copilot Studio
Copilot Studio has an information exposure vulnerability allowing unauthenticated attackers to view sensitive details. The issue can be exploited via network attack vectors.
disclosed CVENo confirmed exploitation, so this record is tracked as a disclosed vulnerability and not counted as an incident. It moves into the counts if CISA or the vendor confirms exploitation. Why
- CVSS
- 7.4
- EPSS
- 0.01 · top 36% · 2026-11-13
- fix status
- Fix status unknown
- first report
- 9 Oct 2024
- last update
- 9 Oct 2024
- CVE ids
Timeline · 1
Sources · 1
Advisories and databases
- 2024-10-09CVE-2024-43610: Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive…NVD · nvd.nist.gov/vuln/detail/CVE-2024-43610
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- lane
- Patch now
- AI role
- Attack on AI
- categories
- Infrastructure vulnerability
- severity
- 2 · Disclosed vulnerability
- fix status
- Fix status unknown
- targets
- Microsoft
- owasp llm top 10
- LLM03:2025 Supply Chain
- mitre atlas
- no technique for these categories
- dates
- happened 9 Oct 2024 · first reported 9 Oct 2024
- origin
- NVDVulnerability record from NVD / the GitHub Advisory Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- record
- confidence 0.95 · created 2026-10-18 10:04Z · updated 2026-10-18 10:04Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# CVE-2024-43610: Microsoft Copilot Studio information disclosure https://gcdradar.vercel.app/incidents/cve-2024-43610-microsoft-copilot-studio-information-disclosu · AIR-2024-0259 · closed 2024-10-09 - Lane: Patch now - Severity: 2 (Disclosed vulnerability) - Fix status: Fix status unknown - First reported: 2024-10-09 - AI role: Attack on AI - Products: Copilot Studio - CVE ids: CVE-2024-43610 - CVSS: 7.4 ## Summary Copilot Studio has an information exposure vulnerability allowing unauthenticated attackers to view sensitive details. The issue can be exploited via network attack vectors. ## What to do No action recorded; read the sources below and the vendor's advisory. ## Latest updates - 2024-10-09: CVE-2024-43610: Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive… (https://nvd.nist.gov/vuln/detail/CVE-2024-43610) ## Sources - 2024-10-09 NVD: CVE-2024-43610: Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive… https://nvd.nist.gov/vuln/detail/CVE-2024-43610 Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- closed9.3Copilot Studio CVE-2024-49038: XSS vulnerability in Microsoft Copilot Studio
Patch now · Disclosed · since 26 Nov 2024 · CVE-2024-49038
AI - closed8.5Copilot Studio CVE-2024-38206: SSRF protection bypass in Microsoft Copilot Studio
Patch now · Disclosed · since 6 Aug 2024 · CVE-2024-38206
AI - closed5.7GitHub Copilot CVE-2025-64660: GitHub Copilot and VS Code Access Control Vulnerability
Patch now · Disclosed · since 20 Nov 2025 · CVE-2025-64660
AI - closed5.0GitHub Copilot CVE-2025-62453: GitHub Copilot and VS Code Generative AI Output Validation Flaw
Patch now · Disclosed · since 11 Nov 2025 · CVE-2025-62453
AI - closed7.8GitHub Copilot CVE-2025-53773: Command Injection Vulnerability in GitHub Copilot and Visual Studio
Patch now · Disclosed · since 12 Aug 2025 · CVE-2025-53773
AI - closed8.2Microsoft 365 Copilot CVE-2025-53787: Microsoft 365 Copilot BizChat Information Disclosure Vulnerability
Patch now · Disclosed · since 7 Aug 2025 · CVE-2025-53787
AI