Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.6
CVE-2026-78501: Microsoft 365 Copilot Business Chat can leak data
CVE-2026-78501 · published 1 month ago
Summary
The Business Chat feature in Microsoft 365 Copilot may let an unauthorized user cause it to send internal information outside your network. This could expose confidential details without your consent. Apply the latest updates from Microsoft and review your chat usage policies to mitigate the risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | microsoft 365 copilot's business chat | - |
| microsoft | 365_copilot_chat |
All versions
cpe:2.3:a:microsoft:365_copilot_chat:-:*:*:*:*:*:*:* |
Original advisory text
Microsoft 365 Copilot Business Chat Information Disclosure Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78501 vendor-advisory patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
8.6
High
Type
CWE-77Command Injection
CWE-923Improper Restriction of Communication Channel to Intended Endpoints
Timeline
Published17 Sep 2026
Updated4 Nov 2026
First seen17 Sep 2026
Track software like this
Free during beta