---
title: "Microsoft 365 copilot vulnerabilities and CVEs"
url: https://radicalnotion.ai/vendor/microsoft/365-copilot
type: product
description: "Microsoft 365 copilot has 57 published CVEs, 0 in CISA KEV and 0 with public exploits."
updated: 2026-10-13
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# Microsoft 365 copilot vulnerabilities

Vendor: [Microsoft](https://radicalnotion.ai/vendor/microsoft)

- **Published CVEs:** 57
- **In CISA KEV:** 0
- **With a public exploit:** 0
- **With a patch:** 57
- **Average CVSS:** 7.9
- **First CVE:** 2021-12-15
- **Latest CVE:** 2026-10-13

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 12 |
| High | 37 |
| Medium | 7 |
| Low | 1 |
| Unscored | 0 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-416](https://radicalnotion.ai/cwe/cwe-416) | Use After Free | 13 |
| [CWE-77](https://radicalnotion.ai/cwe/cwe-77) | Improper Neutralization of Special Elements used in a Command | 9 |
| [CWE-122](https://radicalnotion.ai/cwe/cwe-122) | Heap-based Buffer Overflow | 8 |
| [CWE-843](https://radicalnotion.ai/cwe/cwe-843) | Access of Resource Using Incompatible Type | 4 |
| [CWE-601](https://radicalnotion.ai/cwe/cwe-601) | URL Redirection to Untrusted Site | 3 |
| [CWE-284](https://radicalnotion.ai/cwe/cwe-284) | Improper Access Control | 3 |
| [CWE-125](https://radicalnotion.ai/cwe/cwe-125) | Out-of-bounds Read | 2 |
| [CWE-126](https://radicalnotion.ai/cwe/cwe-126) | Buffer Over-read | 2 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2021 | 1 |
| 2022 | 0 |
| 2023 | 2 |
| 2024 | 1 |
| 2025 | 21 |
| 2026 | 32 |

## Affected versions (top 24 of 33)

| Version | Kind | CVEs |
| --- | --- | --- |
| \< 16.0.19822.20000 | range | 4 |
| \< 16.0.19822.20190 | range | 3 |
| \< 16.0.18827.20000 | range | 2 |
| \< 16.0.19127.20000 | range | 2 |
| \< 16.0.19328.20000 | range | 2 |
| \< 16.0.19426.20044 | range | 2 |
| \< 16.0.16827.20138 | range | 1 |
| \< 16.0.18730.20000 | range | 1 |
| \< 16.0.18925.20000 | range | 1 |
| \< 16.0.19220.20000 | range | 1 |
| \< 16.0.19815.10000 | range | 1 |
| \< 18.2110.13110.0 | range | 1 |
| 16.0.19822.20000 | patched | 4 |
| 16.0.19822.20190 | patched | 3 |
| 16.0.18827.20000 | patched | 2 |
| 16.0.19127.20000 | patched | 2 |
| 16.0.19328.20000 | patched | 2 |
| 16.0.19426.20044 | patched | 2 |
| 16.0.16827.20138 | patched | 1 |
| 16.0.18730.20000 | patched | 1 |
| 16.0.18925.20000 | patched | 1 |
| 16.0.19220.20000 | patched | 1 |
| 16.0.19815.10000 | patched | 1 |
| 16.0.20430.20000 | patched | 1 |

## CVEs (first 30 of 57, most severe first)

| CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2026-85881 | Microsoft Office Graphics Elevation of Privilege Vulnerability | high | 8.0 | No | No | Yes |
| CVE-2026-85887 | M365 Copilot Information Disclosure Vulnerability | high | 7.7 | No | No | Yes |
| CVE-2026-85885 | Microsoft 365 Copilot Elevation of Privilege Vulnerability | critical | 9.9 | No | No | Yes |
| CVE-2026-50517 | Microsoft M365 Copilot Remote Code Execution Vulnerability | critical | 9.9 | No | No | Yes |
| CVE-2026-58617 | M365 Copilot for iOS Elevation of Privilege Vulnerability | critical | 9.8 | No | No | Yes |
| CVE-2026-50387 | Windows GDI Elevation of Privilege Vulnerability | high | 7.8 | No | No | Yes |
| CVE-2026-48561 | Microsoft Edge Copilot Remote Code Execution Vulnerability | critical | 9.6 | No | No | Yes |
| CVE-2026-41106 | Microsoft 365 Copilot Elevation of Privilege Vulnerability | critical | 9.3 | No | No | Yes |
| CVE-2026-47645 | Microsoft 365 Copilot's Business Chat Elevation of Privilege Vulnerability | high | 8.8 | No | No | Yes |
| CVE-2026-42895 | Microsoft Copilot Tampering Vulnerability | high | 7.5 | No | No | Yes |
| CVE-2026-54130 | M365 Copilot Information Disclosure Vulnerability | critical | 9.8 | No | No | Yes |
| CVE-2026-45463 | Microsoft Office Remote Code Execution Vulnerability | high | 8.4 | No | No | Yes |
| CVE-2026-45461 | Microsoft Office Remote Code Execution Vulnerability | high | 8.4 | No | No | Yes |
| CVE-2026-45460 | Microsoft Office Information Disclosure Vulnerability | medium | 4.7 | No | No | Yes |
| CVE-2026-45474 | Microsoft Office Remote Code Execution Vulnerability | high | 8.4 | No | No | Yes |
| CVE-2026-45472 | Microsoft Office Remote Code Execution Vulnerability | high | 8.4 | No | No | Yes |
| CVE-2026-45497 | Microsoft M365 Copilot Remote Code Execution Vulnerability | high | 8.8 | No | No | Yes |
| CVE-2026-42824 | M365 Copilot Information Disclosure Vulnerability | high | 7.5 | No | No | Yes |
| CVE-2026-41090 | Microsoft Copilot Tampering Vulnerability | critical | 9.3 | No | No | Yes |
| CVE-2026-42827 | M365 Copilot Information Disclosure Vulnerability | high | 7.5 | No | No | Yes |
| CVE-2026-42831 | Microsoft Office Remote Code Execution Vulnerability | high | 7.8 | No | No | Yes |
| CVE-2026-41614 | M365 Copilot for Desktop Spoofing Vulnerability | medium | 6.2 | No | No | Yes |
| CVE-2026-41100 | Microsoft 365 Copilot for Android Spoofing Vulnerability | medium | 4.4 | No | No | Yes |
| CVE-2026-40363 | Microsoft Office Remote Code Execution Vulnerability | high | 8.4 | No | No | Yes |
| CVE-2026-33102 | Microsoft 365 Copilot Elevation of Privilege Vulnerability | low | 2.4 | No | No | Yes |
| CVE-2026-24299 | M365 Copilot Information Disclosure Vulnerability | medium | 5.3 | No | No | Yes |
| CVE-2026-26133 | M365 Copilot Information Disclosure Vulnerability | high | 7.1 | No | No | Yes |
| CVE-2026-26110 | Microsoft Office Remote Code Execution Vulnerability | high | 8.4 | No | No | Yes |
| CVE-2026-26134 | Microsoft Office Elevation of Privilege Vulnerability | high | 7.8 | No | No | Yes |
| CVE-2026-25180 | Windows Graphics Component Information Disclosure Vulnerability | medium | 5.5 | No | No | Yes |

## Frequently asked questions

### How many CVEs does Microsoft 365 copilot have?

Microsoft 365 copilot has 57 published CVE records since 2021.

### How many Microsoft 365 copilot CVEs are in CISA KEV?

None of Microsoft 365 copilot's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Are there public exploits for Microsoft 365 copilot vulnerabilities?

No Microsoft 365 copilot CVEs currently have a tracked public exploit in this dataset.

### Which versions of Microsoft 365 copilot are affected?

33 distinct Microsoft 365 copilot versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

### What are the most common weakness types in Microsoft 365 copilot CVEs?

Microsoft 365 copilot's CVEs most often map to these CWE weakness types: CWE-416 (Use After Free), CWE-77 (Improper Neutralization of Special Elements used in a Command), CWE-122 (Heap-based Buffer Overflow), CWE-843 (Access of Resource Using Incompatible Type).

### How many critical Microsoft 365 copilot vulnerabilities are there?

Microsoft 365 copilot has 12 critical and 37 high-severity CVEs.

### What is the average severity of Microsoft 365 copilot CVEs?

The average CVSS base score across Microsoft 365 copilot's scored CVEs is 7.9.

## Other products from this vendor

- [Windows](https://radicalnotion.ai/vendor/microsoft/windows) (11,263 CVEs)
- [Windows Server 2016](https://radicalnotion.ai/vendor/microsoft/windows-server-2016) (7,601 CVEs)
- [Windows Server 2019](https://radicalnotion.ai/vendor/microsoft/windows-server-2019) (7,521 CVEs)
- [Windows Server 2019 (Server Core installation)](https://radicalnotion.ai/vendor/microsoft/windows-server-2019-server-core-installation) (7,112 CVEs)
- [Windows 10 Version 1809 for x64-based Systems](https://radicalnotion.ai/vendor/microsoft/windows-10-version-1809-for-x64-based-systems) (6,747 CVEs)
- [Windows 10 Version 1809 for 32-bit Systems](https://radicalnotion.ai/vendor/microsoft/windows-10-version-1809-for-32-bit-systems) (6,600 CVEs)
- [Windows Server 2016 (Server Core installation)](https://radicalnotion.ai/vendor/microsoft/windows-server-2016-server-core-installation) (6,565 CVEs)
- [Windows 10 Version 1607 for x64-based Systems](https://radicalnotion.ai/vendor/microsoft/windows-10-version-1607-for-x64-based-systems) (6,207 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/microsoft/365-copilot). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.