Quick answers
- Is CVE-2026-26129 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-26129 being exploited in the wild.
- How severe is CVE-2026-26129?
- High severity, with a CVSS score of 7.5, published 7 May 2026.
- Which products and versions are affected?
- Microsoft 365 Copilot Chat All versions.
- Is there a fix for CVE-2026-26129?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-26129 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-26129?
- Check whether you run Microsoft 365 Copilot Chat or Microsoft Copilot for Microsoft 365. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A command injection vulnerability (CWE-138) exists in Microsoft 365 Copilot due to improper neutralization of special elements within user-supplied commands. An unauthenticated attacker can exploit this over the network by submitting malicious input to the Copilot interface. Successful exploitation allows the attacker to bypass intended command boundaries and gain unauthorized access to information. The vulnerability is rated with a CVSS 3.1 score of 7.5, reflecting high confidentiality impact with no requirement for privileges or user interaction. As an exclusively hosted service, Microsoft typically manages the deployment of fixes directly on the platform.
Affected products
- Microsoft 365 Copilot Chat All versions
Timeline
- 2026-05-07: disclosed: Initial publication of CVE-2026-26129
- 2026-06-01: other: CVE description updated to specify command injection details