Microsoft disclosed a critical (CVSS 9.3) improper cryptographic signature verification vulnerability in Copilot Studio that lets an unauthenticated attacker elevate privileges across a network boundary.
What Is It
CVE-2026-80098 is an improper verification of cryptographic signature issue (CWE-347) in Microsoft Copilot Studio. Per Microsoft's description, the flaw "allows an unauthorized attacker to elevate privileges over a network."
The CVSS 3.1 vector, AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N, describes an attack that is reachable over the network, low in complexity, requires no privileges, and requires no user interaction. The scope is marked Changed, meaning impact extends beyond the vulnerable component's own security authority. Integrity impact is High, confidentiality impact is Low, and there is no availability impact. Base score: 9.3 (Critical), with an exploitability subscore of 3.9 and impact subscore of 4.7.
Why It Matters
The combination of no authentication, no user interaction, low attack complexity, and a changed scope is close to a worst-case exposure profile for a network-facing service. A signature verification failure of this kind undermines the trust decisions that depend on it, and the High integrity rating reflects that an attacker gaining elevated privileges could alter protected data or state.
There is no CISA KEV entry supplied for CVE-2026-80098, so active exploitation is not confirmed in the source material available here.
What's Vulnerable
- Vendor: Microsoft
- Product: Microsoft Copilot Studio
- Affected versions: listed as
-(no discrete version range published)
Microsoft tagged this CVE exclusively-hosted-service, indicating the affected product is a cloud service Microsoft operates rather than software customers install and version themselves. No affected CPE entries were published.
Patch Status
The NVD record was published 2026-09-03 with a vulnerability status of Received, meaning it has not yet completed NVD analysis. No required action, remediation deadline, or patch guidance is present in the supplied data. Because the CVE is flagged as an exclusively hosted service, remediation is generally handled on Microsoft's side; consult the MSRC update guide entry below for authoritative status.
Sources
- Microsoft Security Response Center (MSRC), CVE-2026-80098: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80098
- NVD, CVE-2026-80098: https://nvd.nist.gov/vuln/detail/CVE-2026-80098