CVE-2026-85887

HighCVSS 7.7/10Last modified Sep 28, 2026

Description

Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-732

Affected software

VendorProductVersions
MicrosoftMicrosoft 365 Copilot-

References

Timeline

Published
Sep 18, 2026
Last modified
Sep 28, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-858887.7Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-858899.8Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.CVE-2026-85898.7GitLab has remediated an issue in GitLab EE affecting all versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 CVE-2026-858908.8Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2026-858917.5Exposure of sensitive information to an unauthorized actor in Azure HDInsight allows an unauthorized attacker to disclose information over aCVE-2026-858927.8Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an autCVE-2026-858938.8Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.CVE-2026-858978.8Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2026-858988.8Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute CVE-2026-858998.1Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges over a network.CVE-2026-85908.7Vulnerability in Spotfire Spotfire Enterprise (Spotfire Server modules), Spotfire Spotfire Enterprise with External Consumers (Spotfire ServCVE-2026-859008.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-85887: High severity, CVSS 7.7 | Vulnix