Microsoft Copilot Studio vulnerabilities

5 CVEs affecting Microsoft Copilot Studio, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-80098, published 2026-09-03.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-38206, published 2024-08-06. Medium severity, CVSS 6.5. EPSS: 12.3% chance of exploitation in the next 30 days. An authenticated attacker can bypass Server-Side Request Forgery (SSRF) protection in Microsoft Copilot Studio to leak sensitive information over a network.
• CVE-2026-21520, published 2026-01-22. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector
• CVE-2024-43610, published 2024-10-09. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector
• CVE-2024-49038, published 2024-11-26. Critical severity, CVSS 9.6. EPSS: 1% chance of exploitation in the next 30 days. Improper neutralization of input during web page generation ('Cross-site Scripting') in Copilot Studio by an unauthorized attacker leads to elevation of privilege over a network.
• CVE-2026-80098, published 2026-09-03. Critical severity, CVSS 10.0. EPSS: 0.5% chance of exploitation in the next 30 days. Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network.