CVE-2026-42895

Microsoft Copilot command injection could allow unauthorized tampering

Microsoft · Microsoft 365 Copilot cloud service

First documented disclosure · Review checkpoint

Summary

Microsoft reports that a remote attacker could tamper with data through improper command handling.

Severity and exploitation evidence

Medium · 6.5/10 · CVSS 3.1. Severity source.

Exploitation not established: Microsoft listed exploitation as No in its bulletin.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The service did not correctly neutralize special elements in a command. Microsoft did not identify the command or the affected object.

Conditions required

The vendor vector describes network access by an unauthorized attacker and requires user interaction.

Potential impact

The documented impact is loss of integrity. The sources do not establish host command execution.

Affected versions and configurations

Microsoft 365 Copilot service. A numbered product range was not supplied.

Fix and mitigation status

Microsoft reports full service-side mitigation and says customers have no update to install.

Practical next steps

Use the vendor bulletin to track the service-side resolution. No client-side mitigation was requested.

Operating lesson

Keep untrusted input out of privileged commands and verify the operation performed on behalf of the user.

Evidence and limits

Microsoft’s security release lists June 18 as the publication date. The CVE record followed June 19. Its 6.5 CVSS 3.1 base score is distinct from the vendor’s qualitative severity label.

Sources