CVE-2026-24301

CVE-2026-24301 is a command injection flaw (CWE-77) in Microsoft Copilot in which special elements are not properly neutralized before being used in a command, allowing an unauthorized attacker to send commands over a network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R), exploitation requires no privileges but does require user interaction, which aligns with the related headline reporting that a single click in the Copilot personal experience could trigger exfiltration of data from connected apps. The vulnerability is rated 8.8 (high), and while the description emphasizes information disclosure, the CVSS base score rates confidentiality, integrity, and availability impacts all high. Affected users are those using Microsoft Copilot; the source data does not specify version ranges, and the headline suggests the personal/consumer Copilot experience is implicated. No exploitation is currently known: there is no public proof-of-concept, the CVE is not in CISA KEV, and EPSS puts 30-day exploitation probability at 2.2% (82nd percentile).

What to do: Monitor Microsoft's MSRC advisory for CVE-2026-24301 and apply the Copilot service fixes or updates it references; no fixed version numbers were provided in this data. Because user interaction is required (UI:R), counsel users to avoid clicking untrusted links or content that Copilot processes from connected apps while patching is rolled out. Track EPSS and MSRC for signs of in-the-wild exploitation.