CVE-2026-26164 M365 Copilot Information Disclosure Vulnerability

High 7.5 Published 7 May 2026 Updated 10 Aug 2026

An unauthorized attacker can exploit command injection in Microsoft 365 Copilot Business Chat to disclose sensitive information over the network.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-26164?

CVE-2026-26164 is a high-severity command injection vulnerability in Microsoft 365 Copilot's Business Chat, published on 7 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Weakness: CWE-74

Which versions are affected by CVE-2026-26164?

It affects 1 product.

Products include Microsoft 365 Copilot Chat.

How do I fix CVE-2026-26164?

No fix has been published for CVE-2026-26164 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-26164 being exploited?

There is no known exploitation of CVE-2026-26164 in the wild and no public exploit code.

Sources

Also known as GHSA-qvcj-rgrx-wm72.