GCVE - cpe:2.3:a:microsoft:365_copilot:-:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:microsoft:365_copilot:-:*:*:*:*:*:*:*

part: a version: - update: *

Vendor	Microsoft (`67206627-3ef6-5870-9d98-26a9f2e7065c`)
Product	365 Copilot (`25633fd3-6171-58e7-b245-f55a39bf6e74`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-33102`	vulnerable	2026-06-08 07:57:18.629306	Microsoft 365 Copilot Elevation of Privilege Vulnerability CRITICAL (9.3) Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network. Published: 2026-04-23T21:35:48.984Z Updated: 2026-06-19T16:07:24.414Z Open on db.gcve.eu Reference links https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33102	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-24307`	vulnerable	2026-06-08 07:51:17.463271	M365 Copilot Information Disclosure Vulnerability CRITICAL (9.3) Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network. Published: 2026-01-22T22:47:36.934Z Updated: 2026-04-01T13:49:25.685Z Open on db.gcve.eu Reference links https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24307	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-24299`	vulnerable	2026-06-08 07:51:17.449257	M365 Copilot Information Disclosure Vulnerability MEDIUM (5.3) Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network. Published: 2026-03-19T21:06:24.955Z Updated: 2026-06-19T18:18:01.445Z Open on db.gcve.eu Reference links https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24299	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-32711`	vulnerable	2026-06-08 07:19:00.547170	M365 Copilot Information Disclosure Vulnerability CRITICAL (9.3) Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network. Published: 2025-06-11T13:22:38.935Z Updated: 2026-02-26T17:50:41.404Z Open on db.gcve.eu Reference links https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32711	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.