Copilot Studio
Filed as: copilot studio, Microsoft Copilot Studio
Records
6
Disclosed CVEs
5
Exploited (sev 3–4)
0
CISA KEV flagged
0
Newest record 2026-09-03 · 5 distinct CVE ids · open in the explorer (the explorer matches the first product a record names, so it can list fewer)
Patch now: confirmed exploitation or KEV · 0
Records at severity 3–4 (exploitation confirmed by CISA, the vendor or reporting) and records flagged as listed in CISA KEV. The KEV flag is the classifier’s cisa-kev tag or a source on the KEV catalog; it is recorded when the collector sees the listing, so a missing flag does not mean a CVE is absent from the catalog.
No record for Copilot Studio has confirmed exploitation or a KEV flag.
Disclosures by month · last 24 months
█ █ █
Nov ’243 disclosed · peak 1 in Nov ’24Oct ’26
Disclosed CVEs, no confirmed exploitation · 5
- 2026-09-03CVE-2026-80098CVE-2026-80098: Cryptographic signature verification flaw in Microsoft Copilot Studio2 Disclosedprivilege-escalation
- 2026-01-22CVE-2026-21520CVE-2026-21520: Microsoft Copilot Studio Information Disclosure2 Disclosedinformation-disclosure
- 2024-11-26CVE-2024-49038CVE-2024-49038: XSS vulnerability in Microsoft Copilot Studio2 Disclosedxss · elevation-of-privilege
- 2024-10-09CVE-2024-43610CVE-2024-43610: Microsoft Copilot Studio information disclosure2 Discloseddata_leak · copilot-studio
- 2024-08-06CVE-2024-38206CVE-2024-38206: SSRF protection bypass in Microsoft Copilot Studio2 Disclosedssrf · copilot
Other incidents: research and unexploited reports · 1
- 2025-11-07Data Exfiltration via Prompt Injections in Copilot Studio Agent1 Researchprompt-injection · copilot-studio · data-exfiltration · agent-hijack
This page lists what has been reported, not what to do about it. Versions and fixes are in each linked advisory; check the vendor’s own advisory before acting.