PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42827 Microsoft CVE debrief

A command injection vulnerability in M365 Copilot allows network-based information disclosure by unauthenticated attackers. The flaw stems from improper neutralization of special elements in commands (CWE-77). With a CVSS 3.1 score of 6.5 (Medium), this vulnerability requires user interaction but no privileges, enabling remote attackers to extract sensitive information. Microsoft has acknowledged this issue through their Security Response Center. The vulnerability was published to NVD on May 22, 2026, with subsequent modification on May 26, 2026, and remains under active analysis.

Vendor
Microsoft
Product
Microsoft 365 Copilot
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-22
Original CVE updated
2026-05-27
Advisory published
2026-05-22
Advisory updated
2026-05-27

Who should care

Organizations using Microsoft 365 Copilot, security teams managing M365 environments, and administrators responsible for AI assistant deployments should prioritize monitoring for patches and assessing exposure through user interaction vectors.

Technical summary

The vulnerability exists in M365 Copilot's handling of command inputs, where special elements are not properly neutralized, allowing injection of unintended commands. This CWE-77 weakness enables an unauthorized attacker to leverage network access and user interaction to disclose information. The attack vector is network-based with low attack complexity, requiring no privileges but user interaction. The confidentiality impact is high while integrity and availability impacts are none.

Defensive priority

medium

Recommended defensive actions

  • Review Microsoft Security Response Center guidance for CVE-2026-42827 when available
  • Assess M365 Copilot deployment scope and user interaction surfaces
  • Monitor for security updates addressing command injection in Copilot components
  • Implement network segmentation for Copilot-integrated environments pending patch
  • Audit command execution contexts in M365 Copilot integrations for injection vectors

Evidence notes

Vendor attribution to Microsoft is inferred from reference domain (msrc.microsoft.com) with low confidence; requires verification.

Official resources

public