CVE-2026-50517: Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.

CVE-2026-50517 is a vulnerability in Microsoft 365 Copilot where deserialization (the process of converting stored data back into usable objects) of untrusted data allows an authorized attacker to execute code over a network. This means someone with legitimate access to the system could run malicious commands remotely by sending specially crafted data to the application.