CVE-2025-32711criticalPrompt injection2025-06-11
CVE-2025-32711 (EchoLeak): zero-click data leak in Microsoft 365 Copilot
AI command injection in Microsoft 365 Copilot let an unauthorised attacker disclose information over a network. Microsoft fixed it server-side.
What it is
NVD: “Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.” Published 11 June 2025.
Microsoft 365 Copilot is a different product from GitHub Copilot; both are listed under Copilot here.
How to check
- No customer action was required; Microsoft patched the service.
How to fix
- Review which mailboxes and SharePoint sites your Copilot deployment can read.
Sources
More advisories for this tool