← All advisories

Critical severity9.3NVD Advisory· Published Jun 11, 2025· Updated Jun 17, 2026

CVE-2025-32711

CVE-2025-32711

Description

Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Affected products

2

Microsoft/M365 Copilotllm-create
Microsoft/365 Copilot BizChatcpe-rescue
Range: -

Patches

Vulnerability mechanics

References

2

msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32711nvdVendor Advisory
www.aim.security/lp/aim-labs-echoleak-m365nvd

News mentions

2

New MemGhost Attack Plants Persistent False Memories in AI Agents Through One Email
The Hacker News · Jul 13, 2026
One-Click Microsoft 365 Copilot Flaw Could Have Let Attackers Steal Emails, Files, and MFA Codes
The Hacker News · Jun 15, 2026