CVE-2026-48561 Microsoft Edge Copilot Remote Code Execution Vulnerability

Critical 9.6 Published 14 Jul 2026 Updated 28 Oct 2026

An attacker can execute arbitrary code remotely via command injection in Microsoft Edge Copilot on Android and iOS.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-48561?

CVE-2026-48561 is a critical command injection vulnerability in Microsoft 365 Copilot, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute code over a network.

Weakness: CWE-77

Which versions are affected by CVE-2026-48561?

It affects 1 product.

Products include Microsoft 365 Copilot.

How do I fix CVE-2026-48561?

No fix has been published for CVE-2026-48561 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-48561 being exploited?

There is no known exploitation of CVE-2026-48561 in the wild and no public exploit code.

All Microsoft 365 Copilot vulnerabilities

Sources

Also known as GHSA-m97f-w34x-vq3w.