CVE-2026-41090

The vulnerability results from improper neutralization of special characters in commands processed by Microsoft Copilot (CWE-77 — command injection). An attacker, by inducing user interaction (UI:R), can submit crafted input data containing malicious elements that are executed in the context of the vulnerable application. The scope of impact extends beyond the direct component (S:C — scope change), which increases the potential consequences of the attack.

An attacker can perform unauthorized data tampering or manipulation of Microsoft Copilot service behavior, exposing a high level of breach of confidentiality (C:H) and integrity (I:H) of processed information.

Patches available from the vendor should be applied in accordance with references published in the Microsoft Security Response Center (MSRC) at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41090

Microsoft Copilot — specific versions indicated in the vendor references (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41090)