Multiple vulnerabilities in Microsoft Copilot Plugin

Description

Multiple vulnerabilities were found in Microsoft Copilot Plugin. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, spoof user interface.

Below is a complete list of vulnerabilities:

1. A remote code execution vulnerability in GitHub Copilot can be exploited remotely to execute arbitrary code.
2. A remote code execution vulnerability in Game: Age of Empires II: Definitive Edition can be exploited remotely to execute arbitrary code.
3. A remote code execution vulnerability in Minecraft Bedrock Dedicated Server can be exploited remotely to execute arbitrary code.
4. A tampering vulnerability in Outlook Copilot can be exploited remotely to spoof user interface.

Original advisories

• CVE-2026-50510

• CVE-2026-50663
• CVE-2026-55010
• CVE-2026-55145

Exploitation

CVE list

• CVE-2026-50663
  critical
• CVE-2026-50510
  critical
• CVE-2026-55010
  unknown
• CVE-2026-55145
  unknown

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com