CVE-2026-85887

Published: Set 18, 2026 Last Modified: Set 18, 2026

ExploitDB:

Other exploit source:

Google Dorks:

HIGH 7,7

Source: [email protected]

Attack Vector: network

Attack Complexity: low

Privileges Required: low

User Interaction: none

Scope: changed

Confidentiality: high

Integrity: none

Availability: none

AI Translation Available

Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network.

732

Draft

Abstraction: Class Structure: Simple

Security Scopes Affected:

Confidentiality Access Control Integrity Other

Potential Impacts:

Read Application Data Read Files Or Directories Gain Privileges Or Assume Identity Modify Application Data Other

Technologies: Not Technology-Specific, Cloud Computing

Likelihood of Exploit: High

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85887