Microsoft Copilot Studio vulnerabilities

3 known vulnerabilities in Microsoft Copilot Studio from Microsoft. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Microsoft Copilot Studio: Improper Neutralization of Special Elements used in a Command

  CVE-2026-21520Jan 22, 2026MicrosoftEPSS 1.53%

  Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector

• 9.6 Critical severity

  Microsoft Copilot Studio: Improper Neutralization of Input During Web Page Generation

  CVE-2024-49038Nov 26, 2024MicrosoftEPSS 1.02%

  Improper neutralization of input during web page generation ('Cross-site Scripting') in Copilot Studio by an unauthorized attacker leads to elevation of privilege over a network.

• 7.5 High severity

  Microsoft Copilot Studio: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2024-43610Oct 9, 2024MicrosoftEPSS 1.05%

  Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector