CVE-2026-24301

mass

Command Injection in Microsoft Copilot Allows Information Disclosure

CVSS 3.1

7.5 high

EPSS

2%p82

Published

Aug 18, 2026 (28d ago)

Modified

Sep 10, 2026

AI analysis

CVE-2026-24301 is a command injection flaw (CWE-77) in Microsoft Copilot in which special elements are not properly neutralized before being used in a command, allowing an unauthorized attacker to send commands over a network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R), exploitation requires no privileges but does require user interaction, which aligns with the related headline reporting that a single click in the Copilot personal experience could trigger exfiltration of data from connected apps. The vulnerability is rated 8.8 (high), and while the description emphasizes information disclosure, the CVSS base score rates confidentiality, integrity, and availability impacts all high. Affected users are those using Microsoft Copilot; the source data does not specify version ranges, and the headline suggests the personal/consumer Copilot experience is implicated. No exploitation is currently known: there is no public proof-of-concept, the CVE is not in CISA KEV, and EPSS puts 30-day exploitation probability at 2.2% (82nd percentile).

What to do: Monitor Microsoft's MSRC advisory for CVE-2026-24301 and apply the Copilot service fixes or updates it references; no fixed version numbers were provided in this data. Because user interaction is required (UI:R), counsel users to avoid clicking untrusted links or content that Copilot processes from connected apps while patching is rolled out. Track EPSS and MSRC for signs of in-the-wild exploitation.

Affected

Microsoft Copilot

—

Estimated exposure

masstens of millions of Copilot users plausibly affected (Microsoft reported roughly 100M Copilot monthly active users in early 2025); the actual affected subset… — Microsoft Copilot is broadly deployed across Windows, Edge, and Microsoft 365 with roughly 100 million reported monthly active users, so the potential user base is mass-scale even though the exact affected versions and user subset are not…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.

Vendors: microsoft
Products: copilot
Weakness: CWE-77
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (2.2%)

In the news1 stories

Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps

Varonis discloses CoSnitch (CVE-2026-24301), three Microsoft Copilot Personal flaws enabling one-click exfiltration of connected-app data; patched August 18, 2026.

Varonis Threat Labs found that an undocumented autorun=1 parameter, paired with the q parameter, lets an attacker-supplied prompt run automatically on page load in a victim's authenticated Copilot session, then exfiltrate data from connected services such as mail, calendar, Google Drive, chat history and the memory store via Copilot's built-in URL fetch to an attacker webhook. A separate memory-poisoning path through web summarization lets a crafted page persist attacker instructions in the user's memory, surviving password changes, session revocation and device re-enrollment. Microsoft shipped patches on August 18, 2026, tracked as CVE-2026-24301, and Varonis found no evidence of in-the-wild exploitation. The flaws were found via 'meta-hacking', asking Copilot itself to reveal the autorun parameter and its protections.

The Hacker NewsAug 18, 17:51 UTC · 28d agoAI safety & security CVE-2026-24301 CVE-2026-242991