CVE-2026-50517

Microsoft · Published July 23, 2026

9.9

CVSS v3.1

CRITICAL

Patch availableGet patch

Description

Microsoft M365 Copilot Remote Code Execution Vulnerability. Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.

Affected Products

Microsoft 365 Copilot

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C