Vulnerability

CERT-In Vulnerability Note CIVN-2026-0331
Information Disclosure Vulnerability in M365 Copilot

Original Issue Date:June 23, 2026

Severity Rating: CRITICAL

Software Affected

Microsoft 365 Copilot

Overview

A vulnerability has been reported in Microsoft 365 Copilot (M365 Copilot) which could allow an unauthorized attacker to disclose sensitive information over a network.

Target Audience:
Organizations and individuals using Microsoft 365 Copilot.

Risk Assessment:
High risk of unauthorized access of data and data manipulation.

Impact Assessment:
Exposure of sensitive information, unauthorized access to data, and compromise of confidentiality.

Description

Microsoft 365 Copilot (M365 Copilot) is an AI assistant integrated into Microsoft 365 apps like Word, Excel, PowerPoint, Outlook, and Teams to help users generate content, analyze data, and summarize information.

A vulnerability exists in Microsoft 365 Copilot (M365 Copilot) due to missing authentication for a critical function. An unauthorized attacker could exploit this vulnerability over a network.

Successful exploitation of the vulnerability could allow an unauthorized attacker to disclose sensitive information over a network.

Solution

Apply appropriate software updates as mentioned:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54130

Vendor Information

Microsoft
https://www.microsoft.com/en-in/

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54130

CVE Name
CVE-2026-54130

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India