CVE-2024-38206: An authenticated attacker can bypass Server-Side Request Forgery (SSRF) protection in Microsoft Copilot Studio to leak s
highvulnerabilityLLM-Specific
security
Summary
CVE-2024-38206 is a vulnerability in Microsoft Copilot Studio where an authenticated attacker (someone with valid login credentials) can bypass SSRF protection (security that prevents a server from being tricked into making unwanted network requests) to leak sensitive information over a network.
Solution / Mitigation
Patch available from Microsoft Corporation at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38206
Vulnerability Details
CVSS Score
8.5(high)
EPSS (30-day exploit probability)
EPSS: 2.3%
Classification
Attack Type
RAG Poisoning
Attack SophisticationModerate
Impact (CIA+S)
confidentialityintegrity
Affected Vendors
Microsoft
Related Issues
Original source: https://nvd.nist.gov/vuln/detail/CVE-2024-38206
First tracked: February 15, 2026 at 08:51 PM
Classified by LLM (prompt v3) · confidence: 85%