Microsoft discloses fixed Copilot command-injection flaw
Microsoft published CVE-2026-45497 for a Microsoft M365 Copilot remote code execution vulnerability. The Microsoft Security Response Center says the command-injection flaw has already been fully mitigated by Microsoft and requires no customer action. NVD lists the issue as a high-severity vulnerability with Microsoft as the source.
Reporting teams are starting to use Copilot around summaries, formulas, models, and analysis, but many still do not have a clear review trail for AI-assisted outputs. A fixed cloud-service CVE is not a reason to panic, yet it is a reminder that Copilot sits close to work people trust. The practical risk for report builders is not only exploitation. It is letting AI-generated explanations, measures, or model changes move into business decisions without a visible check against the source data and metric definition.
Analysis
Do not disable Copilot because of this fixed issue. Instead, add one review rule: any Copilot-assisted measure, summary, or model change must show the source data, the calculation, and the human reviewer before it appears in a recurring report.
Source note
Pulse published by Collab365 Spaces. Cite as "Microsoft discloses fixed Copilot command-injection flaw", Collab365 Spaces. 2 sources referenced.