Opinions, tips, and news orbiting Microsoft
Improper neutralization of special elements used in a command (‘command injection’) in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network. Continue reading CVE-2026-42895 Microsoft Copilot Tampering Vulnerability
Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network. Continue reading CVE-2026-54130 M365 Copilot Information Disclosure Vulnerability
Improper access control in Microsoft Dynamics 365 allows an authorized attacker to elevate privileges over a network. Continue reading CVE-2026-47647 Dynamics 365 Elevation of Privilege Vulnerability
Execution with unnecessary privileges in Azure Synapse allows an authorized attacker to elevate privileges over a network. Continue reading CVE-2026-48584 Microsoft Azure Synapse Elevation of Privilege Vulnerability
Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network. Continue reading CVE-2026-48582 Microsoft Exchange Online Elevation of Privilege Vulnerability
Url redirection to untrusted site (‘open redirect’) in Microsoft 365 Copilot’s Business Chat allows an unauthorized attacker to elevate privileges over a network. Continue reading CVE-2026-47645 Microsoft 365 Copilot’s Business Chat Elevation of Privilege Vulnerability
Microsoft has been named a Leader in The Forrester Wave™: Extended Detection and Response Platforms, Q2 2026.
The post Forrester names Microsoft a Leader in the 2026 Extended Detection and Response Platforms Wave™ report appeared first on Microsoft Security Blog.