In Microsoft 365 Copilot, an attacker can exploit improper neutralization of special elements used in a command, resulting in command injection. This flaw enables an unauthorized user to execute arbitrary commands or commands that tamper with the system over a network, potentially compromising confidentiality, integrity, or availability of the affected services.

Microsoft 365 Copilot is the affected product. No specific version information is provided; all current deployments of Microsoft 365 Copilot may be impacted.

The CVSS score of 6.5 indicates a moderate severity vulnerability. The EPSS score is not available, so precise exploitation likelihood cannot be quantified, but the flaw is a classic command injection that can be triggered remotely over the network. The vulnerability is not listed in the CISA KEV catalog. Attackers with network access to Copilot services could feasibly inject malicious commands, leading to unauthorized tampering or execution of arbitrary code.