CVE-2026-80098 Copilot Studio Elevation of Privilege Vulnerability

What is CVE-2026-80098?

CVE-2026-80098 is a critical vulnerability in Microsoft Copilot Studio, published on 3 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network.

Weakness: CWE-347

Which versions are affected by CVE-2026-80098?

It affects 1 product.

Products include Microsoft Copilot Studio.

How do I fix CVE-2026-80098?

No fix has been published for CVE-2026-80098 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-80098 being exploited?

There is no known exploitation of CVE-2026-80098 in the wild and no public exploit code.

Other vulnerabilities in Microsoft Copilot Studio

• CVE-2024-49038 Microsoft Copilot Studio Elevation Of Privilege Vulnerability Critical 9.3
• CVE-2024-38206 Microsoft Copilot Studio Information Disclosure Vulnerability High 8.5
• CVE-2026-21520 Copilot Studio Information Disclosure Vulnerability High 7.5
• CVE-2024-43610 Copilot Studio Information Disclosure Vulnerability High 7.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r9hf-26xj-x88v.