Multiple vulnerabilities in Microsoft Apps

Description

Multiple vulnerabilities were found in Microsoft Apps. Malicious users can exploit these vulnerabilities to obtain sensitive information, bypass security restrictions, gain privileges.

Below is a complete list of vulnerabilities:

1. An information disclosure vulnerability in Word Copilot can be exploited remotely to obtain sensitive information.
2. An information disclosure vulnerability in M365 Copilot can be exploited remotely to obtain sensitive information.

Original advisories

• CVE-2026-21521

• CVE-2026-24307

Related products

• Microsoft-Word
• Microsoft-365

CVE list

• CVE-2026-21521
  high
• CVE-2026-24307
  critical

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com