CVE-2026-78501: Command injection vulnerability in Microsoft 365 Copilot Business Chat

# CVE-2026-78501: Command injection vulnerability in Microsoft 365 Copilot Business Chat

https://gcdradar.vercel.app/incidents/cve-2026-78501-command-injection-vulnerability-in-microsoft · AIR-2026-0145 · closed 2026-09-17

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-09-17
- AI role: Attack on AI
- Products: Microsoft 365 Copilot Business Chat
- CVE ids: CVE-2026-78501
- CVSS: 7.4

## Summary

A command injection vulnerability in Microsoft 365 Copilot Business Chat allows unauthorized information disclosure over a network. Microsoft released patches to address the issue.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-10-06: CVE-2026-78501 Microsoft 365 Copilot Business Chat Information Disclosure Vulnerability (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78501)
- 2026-09-17: CVE-2026-78501: Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat… (https://nvd.nist.gov/vuln/detail/CVE-2026-78501)

## Sources

- 2026-09-17 NVD: CVE-2026-78501: Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat… https://nvd.nist.gov/vuln/detail/CVE-2026-78501
- 2026-10-06 MSRC: CVE-2026-78501 Microsoft 365 Copilot Business Chat Information Disclosure Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78501

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.