CVE-2026-85887

Microsoft · Published September 17, 2026

7.7

CVSS v3.1

HIGH

Patch availableGet patch

Description

M365 Copilot Information Disclosure Vulnerability. Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network.

Affected Products

Microsoft 365 Copilot

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C