Vulnerability record · CVE-2026-21521 · published 22 January 2026

CVE-2026-21521: Microsoft 365 word copilot vulnerability

Microsoft · 365 Word Copilot

Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose information over a network.

7.4 CVSS 3.1 High EPSS 0.60% · top 53.5% CWE-150 · CWE-150

7.4CVSS 3.1 base score

0.60%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

1References

17 Jun 2026Last modified by NVD

Description

Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose information over a network.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

365 Word Copilot Microsoft

References

Link	Tags
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21521	Vendor Advisory

Track CVE-2026-21521 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.3CVE-2025-59252Microsoft 365 word copilot command injection vulnerabilityImproper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose informatio…EPSS 0.57%9 Oct 2025

Source: NIST National Vulnerability Database (record CVE-2026-21521), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.