Microsoft Copilot Information Disclosure Vulnerability

Summary

Vulnerabilities 1

• Medium 6.5
  CVE-2026-26136

  Microsoft Copilot Information Disclosure Vulnerability

  Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.

  Microsoft Microsoft Copilot
  Mar 19, 2026

Revision history

1. 2026-03-19 #1

   Information published.

References

• CVE-2026-26136 Microsoft Copilot Information Disclosure Vulnerability - HTML
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26136
• Microsoft Exploitability Index
  https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
• Microsoft Support Lifecycle
  https://support.microsoft.com/lifecycle
• Common Vulnerability Scoring System
  https://www.first.org/cvss