CVE-2026-48561: Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unaut

CVE-2026-48561 is a command injection vulnerability (a flaw where an attacker tricks software into running unintended commands by inserting special characters into input) in Microsoft Copilot that allows an unauthorized attacker to execute code over a network. The vulnerability stems from improper handling of special elements in commands. Details about the severity and available fixes are still being assessed.