GCD AI RADAR
products/microsoft-365-copilot

Microsoft 365 Copilot

Filed as: Microsoft 365 Copilot BizChat, Microsoft 365 Copilot Business Chat

Records
8
Disclosed CVEs
5
Exploited (sev 3–4)
0
CISA KEV flagged
0

Newest record 2026-09-17 · 5 distinct CVE ids · open in the explorer (the explorer matches the first product a record names, so it can list fewer)

Patch now: confirmed exploitation or KEV · 0

Records at severity 3–4 (exploitation confirmed by CISA, the vendor or reporting) and records flagged as listed in CISA KEV. The KEV flag is the classifier’s cisa-kev tag or a source on the KEV catalog; it is recorded when the collector sees the listing, so a missing flag does not mean a CVE is absent from the catalog.

No record for Microsoft 365 Copilot has confirmed exploitation or a KEV flag.

Disclosures by month · last 24 months

Nov ’245 disclosed · peak 2 in Aug ’25Oct ’26

Disclosed CVEs, no confirmed exploitation · 5

  1. 2026-09-17
    CVE-2026-78501
    CVE-2026-78501: Command injection vulnerability in Microsoft 365 Copilot Business Chat
    2 Disclosedmicrosoft · copilot
    record AIR-2026-0145NVD ↗
  2. 2026-07-14
    CVE-2026-58617
    CVE-2026-58617: Privilege escalation vulnerability in Microsoft 365 Copilot
    2 Disclosedprivilege-escalation
    record AIR-2026-1182NVD ↗
  3. 2026-06-19
    CVE-2026-47645
    CVE-2026-47645: Open redirect vulnerability in Microsoft 365 Copilot Business Chat
    2 Disclosedinfra_vuln
    record AIR-2026-1117NVD ↗
  4. 2025-08-07
    CVE-2025-53787
    CVE-2025-53787: Microsoft 365 Copilot BizChat Information Disclosure Vulnerability
    2 Disclosedinformation-disclosure · copilot
    record AIR-2025-0466NVD ↗
  5. 2025-08-07
    CVE-2025-53774
    CVE-2025-53774: Microsoft 365 Copilot BizChat Information Disclosure Vulnerability
    2 Disclosedinformation-disclosure · copilot
    record AIR-2025-0465NVD ↗

Other incidents: research and unexploited reports · 3

  1. 2026-06-30
    EchoLeak Zero-Click Prompt Injection on M365 Copilot
    1 Researchecholeak · prompt-injection · m365-copilot · rag
    record AIR-2026-0356MITRE ATLAS ↗
  2. 2025-07-04
    Microsoft 365 Copilot Flaw Allowed Unlogged File Access
    2 Disclosedmicrosoft · copilot · audit-log · vulnerability
    record AIR-2025-0124AI Incident Database ↗
  3. 2025-03-14
    Microsoft 365 Copilot Financial Transaction Hijacking via RAG
    1 Researchindirect-prompt-injection · rag · copilot
    record AIR-2025-0051MITRE ATLAS ↗

This page lists what has been reported, not what to do about it. Versions and fixes are in each linked advisory; check the vendor’s own advisory before acting.