Microsoft 365 Copilot

Exploited or KEV-listed · 0

Records at severity 3–4 (exploitation confirmed by CISA, the vendor or reporting) and records flagged as listed in CISA KEV. The KEV flag is the classifier’s cisa-kev tag or a source on the KEV catalog; it is recorded when the collector sees the listing, so a missing flag does not mean a CVE is absent from the catalog.

No record for Microsoft 365 Copilot has confirmed exploitation or a KEV flag.

Disclosed CVEs, no confirmed exploitation · 5

1. closed7.4
   Microsoft 365 Copilot CVE-2026-78501: Command injection vulnerability in Microsoft 365 Copilot Business Chat

   Disclosed · since 17 Sep 2026 · updated 6 Oct 2026 · CVE-2026-78501

   AI
2. closed8.1
   Microsoft 365 Copilot CVE-2026-58617: Privilege escalation vulnerability in Microsoft 365 Copilot

   Disclosed · since 14 Jul 2026 · CVE-2026-58617

   AI
3. closed8.8
   Microsoft 365 Copilot CVE-2026-47645: Open redirect vulnerability in Microsoft 365 Copilot Business Chat

   Disclosed · since 19 Jun 2026 · CVE-2026-47645

   AI
4. closed8.2
   Microsoft 365 Copilot CVE-2025-53787: Microsoft 365 Copilot BizChat Information Disclosure Vulnerability

   Disclosed · since 7 Aug 2025 · CVE-2025-53787

   AI
5. closed6.5
   Microsoft 365 Copilot CVE-2025-53774: Microsoft 365 Copilot BizChat Information Disclosure Vulnerability

   Disclosed · since 7 Aug 2025 · CVE-2025-53774

   AI

Other incidents: research and unexploited reports · 3

1. closed
   Microsoft 365 Copilot EchoLeak Zero-Click Prompt Injection on M365 Copilot

   Research · since May 2025 (approx.)

   AI
2. closed
   Microsoft 365 Copilot Microsoft 365 Copilot Flaw Allowed Unlogged File Access

   Disclosed · since 4 Jul 2025

   AI
3. closed
   Microsoft 365 Copilot Microsoft 365 Copilot Financial Transaction Hijacking via RAG

   Research · since 8 Aug 2024

   AI