CVE-2025-32711

—1

CVSS 3.1

7.5 high

EPSS

7%p94

Published

Jun 11, 2025 (Jun 11, 2025)

Modified

Jun 17, 2026

Description

Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Vendors: microsoft
Products: 365 copilot
Weakness: CWE-74
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (7.4%)

In the news6 stories

New MemGhost Attack Plants Persistent False Memories in AI Agents Through One Email

The Hacker NewsJul 15, 00:00 UTC · Jul 15, 2026Data breach CVE-2025-327111

60

One-Click Microsoft 365 Copilot Flaw Could Have Let Attackers Steal Emails, Files, and MFA Codes

The Hacker NewsJun 15, 00:00 UTC · Jun 15, 2026Exploit / PoC in the wildCVE-2026-42824 CVE-2025-327111

60

⚡ Weekly Recap: iPhone Spyware, Microsoft 0-Day, TokenBreak Hack, AI Data Leaks and More

The Hacker NewsOct 28, 08:29 UTC · Oct 28, 2025Malware in the wildCVE-2025-43200 CVE-2025-32711 CVE-2025-33053+24 CVEs2

60

Cato Networks acquires Aim Security to bring AI protection into SASE Cloud

Help Net SecuritySep 4, 00:00 UTC · Sep 4, 2025Data breach CVE-2025-327111

60

New Agent Data Injection Attack Can Make AI Agents Misclick or Run Attacker Commands

The Hacker NewsJul 15, 00:00 UTC · Jul 15, 2026Exploit / PoC CVE-2025-327111

50

Salesforce Patches Critical ForcedLeak Bug Exposing CRM Data via AI Prompt Injection

The Hacker NewsSep 26, 12:36 UTC · Sep 26, 2025AI safety & security CVE-2025-32711

35