Microsoft

Information published.

Exposure of sensitive information to an unauthorized actor in Cost Management Interactive Experiences allows an unauthorized attacker to disclose information over a network.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an authorized attacker to perform spoofing over a network.

Improper authentication in Azure Bot Service allows an authorized attacker to elevate privileges over a network.

Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network.

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.

Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Improper access control in Microsoft Dynamics 365 allows an authorized attacker to elevate privileges over a network.

Execution with unnecessary privileges in Azure Synapse allows an authorized attacker to elevate privileges over a network.

Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.

Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a network.

Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Customer Voice allows an unauthorized attacker to perform spoofing over a network.

Information published.

Information published.

Information published.

Information published.

Information published.

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ". We are working to provide a high quality security update that addresses this vulnerability. We will provide information in this CVE when the update is available.

Information published.

This CVE was assigned by Chrome.  Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2025) for more information.