Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-78501 is a high-severity Command Injection (CWE-77) vulnerability in Microsoft 365 Copilot Chat. Its CVSS base score is 7.4 (High).
Operationally, ranked in the top 42% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Enterprise AI Assistants.
The strongest mitigations our analysis identified map to IA-3 (Device Identification and Authentication) and SA-11 (Developer Testing and Evaluation) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-82590
Vulnerability Data
Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Enterprise AI Assistants
- Risk Domain
- N/A
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: copilot
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires unique identification and authentication of devices before establishing a communications session.
Developer testing and evaluation can discover command-construction flaws before deployment.
Secure engineering principles include proper neutralization and safe command construction practices.
Enforces authenticity of communication sessions so the system only exchanges data with verified intended endpoints.
Protects transmitted information with cryptographic integrity mechanisms that implicitly verify endpoint identity.
Input validation directly stops construction of commands from untrusted data containing special elements.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Network security controls directly enforce endpoint validation and channel restrictions.
A.8.21 mandates identifying/implementing network service security features (authentication, encryption, connection controls, authorization, monitoring, allowed endpoints via rules) and ensuring providers do so, which stops most improper-restriction cases from being exploitable; the bounded remainder is product-level endpoint validation logic (e.g. cert pinning, strict hostname checks) that lives in code rather than in service configuration or provider agreement.
Cryptography can protect channels but does not guarantee correct endpoint identity without additional controls.
A.8.25 mandates secure SDLC practices including secure coding guidelines, security requirements, checkpoints, testing (scans/penetration), and developer training that reduce command injection defects, but leaves a minority slice (e.g. incomplete implementation of those practices, outsourced development without full assurance, or post-SDLC changes) where the weakness can still arise and be exploitable.
Application security requirements explicitly call for controls against injection flaws including command injection.
A.8.27 mandates security-by-design principles (e.g. distrust external input, secure session control, data validation/sanitization, least privilege) and design reviews that can stop command injection from being introduced, but this is only a minority slice of CWE-77 because the weakness can still arise in code that bypasses those principles, in non-reviewed components, or in runtime injection vectors the architecture review does not reach.