CVE-2026-24307: critical vulnerability in Microsoft 365 Copilot
M365 Copilot Information Disclosure Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Microsoft 365 Copilot fails to properly validate certain user inputs, allowing attackers to access sensitive information through the network without authorization. This vulnerability can expose confidential data that should be protected.
The vulnerability involves insufficient input validation in M365 Copilot's input handling mechanisms, enabling an unauthenticated network-based attacker to extract sensitive information through crafted requests. The improper validation of a specified input type allows bypass of access controls, resulting in unauthorized information disclosure with no user interaction required.
In the same product, most dangerous first.