CVE-2024-49038: Microsoft Copilot Studio

Critical severity, CVSS 9.6. EPSS: 1% chance of exploitation in the next 30 days.

Improper neutralization of input during web page generation ('Cross-site Scripting') in Copilot Studio by an unauthorized attacker leads to elevation of privilege over a network.

Affected products

• Microsoft Copilot Studio: affected versions not specified

Published 2024-11-26. Last modified 2026-06-17.