cve 2026 45497

CVE-2026-45497 is a Critical remote code execution vulnerability in Microsoft 365 Copilot, caused by command injection. Microsoft disclosed it on June 4, 2026, and the fix was applied server-side in the cloud, requiring no customer patch or configuration action. While this reduces emergency patching pressure, the vulnerability raises important questions about trust, telemetry, and architectural design as Copilot evolves from a sidebar feature into a privileged interface to corporate data. Administrators should review their risk posture and understand the implications of server-side mitigations for cloud-integrated AI tools.