// Microsoft 365CRITICAL
CVE-2026-85885 is a command injection vulnerability (CWE-77) in Microsoft 365 Copilot that allows authorized attackers to elevate privileges remotely with no user interaction required. The CVSS 3.1 score is 9.9 (critical), with complete impact on confidentiality, integrity, and availability. Microsoft has released an official fix managed server-side for the cloud service.
- CVE-2026-85885: CWE-77: Improper Neutralization of Special Eleme(opens in a new tab)
- Microsoft Patches 18 Vulnerabilities in AI, Cloud Products - Sec(opens in a new tab)
- Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unaut(opens in a new tab)
// Get alerts for Microsoft 365