rootpwn

critical · CVSS v3 9.9

CVE-2026-85885

CVE-2026-85885 is a critical command injection vulnerability in Microsoft 365 Copilot. It allows an authorized attacker to escalate privileg

Overview

CVE-2026-85885 is a critical command injection vulnerability in Microsoft 365 Copilot. It allows an authorized attacker to escalate privileges over a network. This matters because it could undermine tenant security controls and expand attacker access within Microsoft 365 environments.

Description

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.

Impact

The vulnerability can affect confidentiality, integrity, and availability by enabling privilege escalation from an authorized account. Organizations using M365 Copilot are most at risk, particularly tenants with broad user access or elevated administrative roles. Successful exploitation could lead to unauthorized access to sensitive data, tampering with tenant settings, or disruption of services. Defenders should treat this as a high-priority identity and tenant security issue.

Remediation

Apply the latest Microsoft security update or vendor-provided fix for M365 Copilot as soon as it is available. Restrict M365 Copilot access to trusted users and apply least-privilege principles. Enforce multi-factor authentication, conditional access, and monitoring for anomalous privilege changes or administrative activity. If patching is delayed, consider disabling or limiting Copilot features for affected users and increase audit log review.

Risk context

CVSS v3 is 9.9, indicating critical severity. No EPSS score is provided, so urgency should be driven by exposure, tenant criticality, and patch availability. Organizations with M365 Copilot enabled should prioritize validation and remediation.

Affected products

  • Microsoft 365 Copilot

Scores

Severity
critical
CVSS v2
9
CVSS v3
9.9
CVSS v4
—
EPSS
—

command-injection privilege-escalation microsoft-365 copilot critical tenant-security

← All CVEs

Related CVEs

critical

CVE-2026-62874

CVE‑2026‑62874 exposes a flaw in Azure Billing where data authenticity is not properly verified. An attacker can exploit this to gain elevated privileges on the network, potentially accessing or modifying billing and subscription data. The vulnerability is critical with a CVSS v3 score of 10.0.

View analysis

critical

CVE-2026-69843

CVE‑2026‑69843 is a critical authentication bypass in Microsoft Fabric that lets an attacker spoof credentials and gain elevated privileges across the network. The flaw allows unauthorized users to impersonate legitimate accounts, potentially accessing sensitive data and services. It is a high‑risk vulnerability that requires immediate attention from defenders.

View analysis

critical

CVE-2026-85878

CVE-2026-85878 exposes an improper authorization flaw in Azure Database for PostgreSQL that lets an authenticated user gain elevated privileges across the network. The vulnerability can be exploited by users who already have access to the database, enabling them to perform actions beyond their intended scope. It is critical because it bypasses normal role boundaries and can lead to widespread compromise of data and services.

View analysis

critical

CVE-2026-93453

SOGo versions before 5.12.11 can construct password-reset links using a client-supplied Origin header as the link authority. This can cause valid recovery tokens to be delivered in links pointing to attacker-controlled domains. It matters because it can enable account takeover for users who rely on SOGo password recovery.

View analysis