External risk intelligence

Copilot Command Injection Information Disclosure.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-59272

The vulnerability involves command injection in a local context within Copilot. As described, it requires local access to perform information disclosure, meaning it is not a service typically exposed to the public internet or accessible via remote network interfaces.

Command Injection

Microsoft 365 Copilot Chat

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified affecting Microsoft 365 Copilot Chat, potentially allowing unauthorized local access for information disclosure. This issue arises from improper handling of command elements, which could enable an attacker to reveal sensitive data. The main concern is confirming whether our environment is relevant and exposed to this type of threat.

Attackers could access local information.
It impacts Microsoft 365 Copilot Chat.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted input to the Copilot feature. This input could lead to the execution of unintended commands on the local system, potentially revealing sensitive information.

Requires local access to the system.
Triggered by specially crafted input to Copilot.
Risks unauthorized local information disclosure.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthorized attacker to disclose information by injecting commands into Copilot. This affects local data and service behavior when supported by the advisory.

Local system data could be exposed.
Attacker could inject commands locally.
Information disclosure may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Microsoft 365 Copilot Chat allows for local information disclosure via command injection. Given the local nature of the attack vector, platform and security teams should prioritize identifying instances of Copilot Chat, confirming local reachability, and understanding which business-critical applications or data may be exposed before planning remediation.

Platform and security teams own this.
Verify local instances and business criticality.
Plan remediation based on exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Microsoft 365 Copilot Chat?

Microsoft 365 Copilot Chat is an AI-powered assistant integrated into the Microsoft 365 ecosystem. It processes user prompts to help generate content, summarize documents, and navigate data across various productivity applications within a user's workflow.

How does this command injection vulnerability work?

This vulnerability is classified as CWE-77, or improper neutralization of special elements in a command. In simple terms, the application fails to properly filter user-provided input, allowing an attacker to insert their own commands into the system. These injected commands are then executed, potentially revealing sensitive information that should remain private.

What is required to trigger this CVE-2025-59272 bug?

An attacker must provide specially crafted input to the Copilot interface to trigger the flaw. The vulnerability requires local access to the system to be effective. It is not triggered by standard, benign interaction with the Copilot feature, as it specifically depends on the injection of malicious command syntax.

Do I need to worry about internet-based attacks?

According to Halo Surface Signal, this threat is considered very unlikely to be exploited over the internet. Because the vulnerability requires local access to the system, it is generally not exposed to public network interfaces or remote attackers. Your primary focus should be on internal environments where users have direct, local access to the software.

When should I take action to address this?

You should prioritize this by identifying all instances of Microsoft 365 Copilot Chat within your organization. Once you have an inventory, assess which systems contain sensitive data and confirm the level of local access available to users. Use this information to coordinate with your security team to monitor for unusual activity and plan necessary updates.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59272

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.