Critical severity9.3NVD Advisory· Published Jun 11, 2025· Updated Jun 17, 2026
CVE-2025-32711
CVE-2025-32711
Description
Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.
Affected products
3- cpe:2.3:a:microsoft:365_copilot:-:*:*:*:*:*:*:*
- Range: -
Patches
Vulnerability mechanics
References
2News mentions
3- New Agent Data Injection Attack Can Make AI Agents Misclick or Run Attacker CommandsThe Hacker News · Jul 16, 2026
- New MemGhost Attack Plants Persistent False Memories in AI Agents Through One EmailThe Hacker News · Jul 13, 2026
- One-Click Microsoft 365 Copilot Flaw Could Have Let Attackers Steal Emails, Files, and MFA CodesThe Hacker News · Jun 15, 2026