Quick answers
- Is CVE-2026-85887 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-85887 being exploited in the wild.
- How severe is CVE-2026-85887?
- High severity, with a CVSS score of 7.7, published 18 September 2026.
- Which products and versions are affected?
- Microsoft M365 Copilot.
- Is there a fix for CVE-2026-85887?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-85887 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-85887?
- Check whether you run Microsoft M365 Copilot. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability is rooted in incorrect permission assignment for a critical resource within M365 Copilot. An authenticated attacker (one who already has authorized access to M365) can exploit improper access controls to access and exfiltrate information they are not entitled to. The attack vector is network-based and requires the attacker to be an authorized user of the system. The vulnerability enables information disclosure, allowing sensitive data to be exposed. Patches from Microsoft are expected to be available through the standard security update process.
Affected products
- Microsoft M365 Copilot
Timeline
- 2026-09-18: disclosed