CVE-2026-50517

Severity

CRITICAL

CVSS

9.9

EPSS

0.01254

Risk score

40.04

CISA KEV

PoC

Published

2026-07-24

Modified

2026-08-14

First seen

2026-08-05

Aliases

EUVD-2026-48457, GHSA-CFM3-7VPC-PX47

Products

Microsoft:Microsoft 365 Copilot -, microsoft:365_copilot

Sources

Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.