HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-42827 — Improper neutralization of special elements used in a command ('command injectio...

·Source: NIST NVD

Updated:

Executive Summary

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Analysis

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network. CVSS Score: 6.5. Published: 2026-05-22T23:16:54.657.

Indicators of Compromise (1)

CVE (1)
CVE-2026-42827
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on May 22, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Mastercard joins Tips cross-currency pilot

Mastercard is working with Denmark's and Sweden's central banks to pilot instant cross-currency payments on the Eurosystem’s Target Instant Payment Settlement (Tips) platform.

Finextra
MEDIUMVulnerability

Hackers Used Meta’s AI Support Bot to Seize Instagram Accounts

The Instagram accounts for the Obama White House and the Chief Master Sergeant of the U.S. Space Force were briefly defaced with pro-Iranian images and messages over the weekend, after instructions began circulating on Telegram showing how to trick Meta's "AI support assistant" bot into resetting account passwords.

Krebs on Security
CRITICALVulnerability

Vulnerability Disclosure in the Age of AI

New article: “ Responsible Disclosure in the Age of AI: A Call for Urgent Action ,” by Melissa Hathaway. Abstract: Artificial intelligence is fundamentally reshaping the balance between vulnerability discovery and remediation. Frontier AI models are now capable of autonomously identifying exploitable software vulnerabilities at unprecedented speed and scale. This development exposes de

Schneier on Security