CVE-2025-59272
Published: 09 October 2025
Summary
CVE-2025-59272 is a critical-severity Command Injection (CWE-77) vulnerability in Microsoft 365 Copilot Chat. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Enterprise AI Assistants; in the Privacy and Disclosure risk domain.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-59272 is a command injection vulnerability (CWE-77) in Copilot due to improper neutralization of special elements used in a command. This flaw enables unauthorized attackers to perform local information disclosure. The vulnerability carries a CVSS v3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N), reflecting its critical severity with network accessibility, low attack complexity, no required privileges or user interaction, and a scope change.
An unauthorized attacker can exploit CVE-2025-59272 remotely over the network without privileges or user interaction. Successful exploitation allows the attacker to achieve high-impact confidentiality loss through local information disclosure on the affected system, alongside low integrity impact and no availability disruption.
The Microsoft Security Response Center advisory provides further details on mitigation and patches at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59272.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-33547
Vulnerability details
Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to perform information disclosure locally.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Enterprise AI Assistants
- Risk Domain
- Privacy and Disclosure
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: copilot
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection (CWE-77) in network-reachable Copilot directly enables remote exploitation of a public-facing app (T1190) and arbitrary command execution (T1059).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires information input validation at entry points to neutralize special elements in commands, directly preventing the command injection vulnerability exploited in CVE-2025-59272.
SI-2 mandates flaw remediation including timely application of vendor patches, directly eliminating the specific command injection flaw in Copilot described in CVE-2025-59272.
AU-13 monitors system areas for unauthorized information disclosure, enabling detection of the local confidentiality impacts resulting from successful command injection in CVE-2025-59272.