CVE-2026-42895 is a command injection vulnerability (CWE-77) in Microsoft 365 Copilot resulting from improper neutralization of special elements used in commands. This vulnerability enables an unauthorized attacker to perform tampering over a network. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity). Microsoft has released an official fix and, as the product is a cloud service, remediation is managed by Microsoft server-side. No active exploitation has been observed.

An attacker could perform command injection leading to tampering with commands in Microsoft 365 Copilot. While confidentiality is not impacted, integrity is compromised. Availability is not affected. No known exploitation in the wild has been reported.

Microsoft has issued an official fix for this vulnerability. As Microsoft 365 Copilot is a cloud service, remediation is managed by Microsoft server-side. Users and administrators should ensure their service is updated per Microsoft's guidance. No additional user action is required beyond applying the official fix.