Microsoft July 2026 Patch Tuesday — GitHub Copilot JetBrains plugin CVE-2026-50510 + M365 Copilot mobile CVE-2026-48561 + M365 Copilot cross-tenant EoP CVE-2026-41106 + M365 Copilot RCE CVE-2026-50517 + VS Code Copilot credential leak CVE-2026-47282 (all patched)

View raw markdownEdit on GitHub ↗

TL;DR

Microsoft's July 2026 Patch Tuesday (2026-07-14, 622 CVEs total — the largest single Patch Tuesday on record) shipped fixes for three unrelated Copilot-family flaws: CVE-2026-50510 (CVSS 7.8) — the GitHub Copilot plugin for JetBrains IDEs mishandled resource names (CWE-641) in a way that, with user interaction, allows full local compromise; CVE-2026-48561 (CVSS 9.6) — Microsoft 365 Copilot for iOS/Android, reachable via Microsoft Edge for Android, would silently accept and act on prompts injected by a malicious website with no confirmation and no origin check; and CVE-2026-41106 (CVSS 9.3, critical) — an elevation-of-privilege flaw in Microsoft 365 Copilot itself where a URL-redirection-to-untrusted-site weakness (CWE-601) could let an attacker cross tenant-isolation boundaries. A fourth, unrelated CVE published over a week later on 2026-07-23 — CVE-2026-50517 (CVSS 9.9, the highest in this batch) — is a deserialization-of-untrusted-data flaw in Microsoft 365 Copilot allowing unauthenticated-adjacent remote code execution with no user interaction. All four are cloud-service or client fixes with no reported in-the-wild exploitation. No action needed beyond updating clients (the two service-side CVEs, 41106 and 50517, required/require zero customer action) — but all four are useful reminders that "Copilot" now spans multiple, independently-vulnerable surfaces (IDE plugin, mobile app, browser integration, core cloud service) that each need their own security tracking.

What happened

CVE-2026-50510 — GitHub Copilot JetBrains plugin

An improper restriction of names for files/resources (CWE-641) in the GitHub Copilot plugin for JetBrains IDEs (IntelliJ IDEA, PyCharm, WebStorm, Rider, Android Studio, and others) allows an attacker who can get a developer to interact with malicious content — a repository, a pull request, or a package — to achieve full compromise of confidentiality, integrity, and availability on the local machine. It requires local access and user interaction (not remotely exploitable on its own), consistent with content-based attack chains this repo has tracked elsewhere (a poisoned repo/PR is the delivery vector, same shape as GuardFall and IDEsaster). All plugin versions before 1.13.0-251 are affected; fixed in 1.13.0-251.

CVE-2026-48561 — Microsoft 365 Copilot mobile, via Edge for Android

Independent researcher Ofek Levin of Enclave found that Microsoft 365 Copilot's mobile apps (iOS and Android) would accept prompts delivered through Microsoft Edge for Android without confirming where they came from. A malicious website, visited in Edge on Android, could silently issue crafted prompts to Copilot — reading or modifying the victim's data with no click beyond visiting the page and no visible confirmation dialog. Microsoft rated this CVSS 9.6 (critical) and confirmed it was never exploited in the wild, with exploitation assessed as unlikely. Fixed the same day (2026-07-14); Edge for Android ≥ 150.0.4078.65 (released 2026-07-13) closes the vector, alongside the Copilot app updates.

This is a different flaw from this repo's already-tracked Microsoft 365 Copilot SearchLeak (CVE-2026-42824, a q=-parameter-to-prompt-injection chain exfiltrating email/OneDrive data via a CSP/Bing-SSRF bypass, patched 2026-06-15) — but it's the same recurring class this repo flagged when writing up SearchLeak: treating a URL, query parameter, or cross-app message as a trusted user prompt rather than untrusted input. Two distinct CVEs against two distinct M365 Copilot surfaces in five weeks is a pattern worth tracking, not a coincidence.

CVE-2026-41106 — Microsoft 365 Copilot cross-tenant elevation of privilege (update 2026-07-21)

A critical (CVSS 9.3) elevation-of-privilege flaw in the core Microsoft 365 Copilot service itself: a URL-redirection-to-untrusted-site weakness (CWE-601) undermined tenant-isolation trust boundaries. Reporting describes an authenticated attacker with some existing M365 access potentially able to reach Copilot's integrations with SharePoint and Entra ID to access data across organizational (tenant) boundaries — a third, distinct Copilot-family CVE from the same July 14 Patch Tuesday batch that this advisory hadn't originally captured. This is a cloud-service-side fix: Microsoft applied the patch on its own infrastructure, so no customer action is required and there is no client version to check. Microsoft reports no evidence of in-the-wild exploitation.

CVE-2026-50517 — Microsoft 365 Copilot remote code execution via deserialization (update 2026-07-25)

Published 2026-07-23 (confirmed on NVD) — the highest-severity Copilot-family flaw tracked in this advisory: CVSS 9.9, a deserialization-of-untrusted-data weakness (CWE-502) in Microsoft 365 Copilot that Microsoft's own advisory describes as letting an "authorized attacker" execute code over the network with no user interaction required. This is a separate CVE from the July 14 Patch Tuesday batch above — it published over a week later and is not part of that batch. Like CVE-2026-41106, this is an "exclusively-hosted service" flaw: Microsoft owns the fix server-side, and as of this writing has not published a detailed remediation statement or confirmed the patch is fully deployed, so treat any M365 Copilot deployment as the responsibility of Microsoft's own rollout rather than something a customer can directly verify. No PoC or in-the-wild exploitation has been reported.

CVE-2026-47282 — VS Code / GitHub Copilot sign-in token disclosure (update 2026-07-29)

A fifth Copilot-family flaw from the same July 14 Patch Tuesday batch this advisory hadn't previously captured: insufficiently protected credentials (CWE-522) in Visual Studio Code and GitHub Copilot could disclose a user's sign-in access token to an unauthorized attacker over a network. Microsoft rates it CVSS 3.1 base score 6.5 (medium) — lower than the other four flaws in this advisory — and exploitation requires the victim to be enticed into opening a malicious file in VS Code (local-vector, user-interaction-required, not a zero-click flaw). Published 2026-07-14 alongside the JetBrains-plugin CVE; affects VS Code versions before 1.128.1, fixed in 1.128.1. A leaked sign-in token could grant an attacker the same data/service access the victim's account has, so treat it with the same urgency as any other credential-disclosure bug even though the CVSS band is lower than its Patch Tuesday siblings.

Am I affected?

  • GitHub Copilot JetBrains plugin: check your plugin version in Settings → Plugins → GitHub Copilot. If it's below 1.13.0-251, update immediately.
  • Microsoft 365 Copilot mobile / Edge for Android: update both apps from your platform's app store. Confirm Edge for Android is ≥ 150.0.4078.65.
  • Microsoft 365 Copilot (CVE-2026-41106, CVE-2026-50517): no client-side action possible or needed for either — both are cloud-service-side fixes. If you operate a multi-tenant M365 environment, this is a good prompt to review Copilot permission scopes, SharePoint external-sharing settings, and Entra ID cross-tenant access policies as defense-in-depth, and to watch the MSRC advisory page for confirmation that CVE-2026-50517's fix has fully rolled out.
  • VS Code / GitHub Copilot (CVE-2026-47282): check Help → About in VS Code. If it's below 1.128.1, update — and avoid opening untrusted files in VS Code until you do.

None of the five flaws has a known IOC set or confirmed in-the-wild exploitation — there's no forensic triage step beyond confirming you're on the patched client versions (and, for the two cloud-service-side CVEs, nothing to confirm at all).

If you are affected

Update is the fix for the two client-side CVEs; there is no rotation or containment step required since Microsoft reports no exploitation occurred for any of the four, and the two cloud-service-side CVEs (CVE-2026-41106, CVE-2026-50517) required no customer action in the first place.

Prevention

→ prevention/package-vetting-checklist.md — for the JetBrains plugin flaw, the same discipline that applies to any "don't blindly open unfamiliar repos/PRs in an AI-integrated IDE" guidance applies here. → prevention/agent-sandboxing.md — treat any AI assistant reachable from a mobile browser or cross-app message channel as attacker-reachable input, not just chat-box input.

Why this matters for vibe coders

"GitHub Copilot" and "Microsoft 365 Copilot" are different products with different attack surfaces, and both had CVEs land in the same Patch Tuesday — a useful reminder to patch every Copilot-branded surface you use (IDE plugin, desktop, mobile, browser integration) independently rather than assuming one update covers them all.

Update 2026-09-18 — Microsoft's September AI-cloud batch: a CVSS 10.0 missing-authentication bug in Azure AI Foundry, a 9.9 command injection in M365 Copilot, and a 10.0 signature-verification bug in Copilot Studio, all server-side and "already mitigated"

Between 2026-09-03 and 2026-09-18 Microsoft published a run of cloud-service CVEs (SecurityWeek counts 18 on 2026-09-18 alone across Azure and Copilot products; Microsoft rates them all critical though the CVSS scores vary) that touch the Copilot family and the platform developers use to build agents. All are Microsoft-hosted; Microsoft's position, as reported by The Hacker News, is that they are fully mitigated with no customer action required, and no exploitation has been reported. Scores and descriptions below are NVD's (CNA secure@microsoft.com), queried via the NVD API on 2026-09-18, because the MSRC update-guide pages render as a bare title to a fetcher:

CVE Product CVSS NVD description Published
CVE-2026-85889 Azure AI Foundry 10.0 "Missing authentication for critical function… allows an unauthorized attacker to elevate privileges over a network" (CWE-306). Reported by Rémy Marot. 2026-09-17
CVE-2026-85885 Microsoft 365 Copilot 9.9 "Improper neutralization of special elements used in a command ('command injection')… allows an authorized attacker to elevate privileges over a network" (CWE-77; PR:L, scope changed). 2026-09-17
CVE-2026-85887 Microsoft 365 Copilot 7.7 "Incorrect permission assignment for critical resource… allows an authorized attacker to disclose information over a network." 2026-09-18
CVE-2026-78501 M365 Copilot Business Chat 7.4 Command injection "allows an unauthorized attacker to disclose information over a network" (UI:R). 2026-09-17
CVE-2026-55946 Microsoft Copilot 6.1 Command injection, unauthenticated, information disclosure (AC:H, UI:R). 2026-09-17
CVE-2026-80098 Copilot Studio 10.0 / 9.3 (two NVD vectors) "Improper verification of cryptographic signature… allows an unauthorized attacker to elevate privileges over a network." 2026-09-03
CVE-2026-70352 Azure AI Language 10.0 Missing authentication for critical function, unauthenticated privilege escalation. 2026-09-03
CVE-2026-69843 Microsoft Fabric 10.0 "Authentication bypass by spoofing… allows an unauthorized attacker to elevate privileges over a network." 2026-09-18

Also in the window, already logged as declined on 2026-09-14: CVE-2026-81381 / CVE-2026-81380 (GitHub Copilot / VS Code credential protection and command injection, September Patch Tuesday, moderate).

What a builder should take from it. Three "command injection" CVEs in M365 Copilot in one week are the prompt-injection-to-privilege pattern this file documented in July (CVE-2026-48561), now recurring on the server side; the Azure AI Foundry and Copilot Studio entries are the agent-hosting control plane itself failing authentication or signature checks. There is nothing to patch locally, but two things to do: check the Azure/M365 audit logs for the disclosure window if you run agents on Foundry or Copilot Studio, and treat Microsoft's "no customer action" as a statement about the fix, not about what may have happened before it — Microsoft has said nothing either way about exploitation beyond "no evidence."

Sources