CVE-2026-85885: Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized

M365 Copilot has a command injection vulnerability (a flaw where special characters in user input can trick the system into running unintended commands), which allows an authorized attacker to gain higher privileges over a network. The vulnerability affects users who already have some level of access to the system.