CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2025-59272

CVSS 9.3v3.1pub. 2025-10-09upd. 2025-12-11

Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to perform information disclosure locally.

🇵🇱 Read Polish description →

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Microsoft 365 Copilot Chat
APP
Microsoft
wszystkie wersje

🟢

PATCH AVAILABLE

Vendor update available. Deploy in standard maintenance cycle.

CWE

CWE-77

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2025-…

Related vulnerabilities

CVE-2026-26137CRITICAL9.9PL ✓ten sam produkt

SSRF w Microsoft Exchange umożliwia eskalację uprawnień sieciowych

CVE-2025-59286CRITICAL9.3PL ✓ten sam produkt

Command Injection w Microsoft 365 Copilot Chat umożliwiający ujawnienie informacji

CVE-2026-26129HIGH7.5ten sam produkt

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an ...

CVE-2026-26164HIGH7.5ten sam produkt

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an ...

CVE-2025-53787HIGH8.2ten sam produkt

Microsoft 365 Copilot BizChat Information Disclosure Vulnerability