CVE-2026-65680: Microsoft OneDrive

Medium severity, CVSS 6.7. EPSS: 0.4% chance of exploitation in the next 30 days.

Improper link resolution before file access ('link following') in Microsoft OneDrive allows an authorized attacker to elevate privileges locally.

Affected products

• Microsoft OneDrive: before 26.095.0519.0003 (fixed in 26.095.0519.0003)

Published 2026-08-11. Last modified 2026-08-17.