Exploitation observed; activity peaked at 5 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-06-19 | 5 | Active Exploitation1Disclosure4 |
| 2026-06-25 | 1 | Patch1 |
🚨 CRITICAL: CVE-2026-54130 (CVSS 9.8) - Missing authentication in M365 Copilot allows unauthorized attackers to disclose information remotely. Patch immediately. #CVE #Vulnerability #PatchNow #ThreatIntel #DFIR https://t.co/zC9jt0FFky
Post summary
CVE‑2026‑54130 is a critical authentication‑bypass vulnerability in M365 Copilot that allows remote information disclosure; users are urged to apply patches immediately.
🔴 CVE-2026-54130 in M365 Copilot is being weaponized, letting attackers access sensitive data via AI-driven info disclosure. Critical CVSS 9.8. Patch immediately—this impacts enterprise workflows globally. #NerdieNews #CyberSecurity #Ransomware https://t.co/etVVjjXwzg
Post summary
CVEs-2026-54130 in Microsoft 365 Copilot is allegedly being exploited in the wild, exposing sensitive data; with a critical CVSS of 9.8, the text urges immediate patching.
CVE-2026-54130 (Microsoft 365 Copilot) is a critical missing-authentication flaw. Copilot’s access to sensitive enterprise content potentially makes the blast radius significant. See full analysis: https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-06-18/TIER_2_CVE-2026-54130.md #DigitalIdentity #DPI #Microsoft365 #AIsecurity
Post summary
The tweet announces a critical missing‑authentication vulnerability (CVE‑2026‑54130) in Microsoft 365 Copilot, linking to an in‑depth analysis but providing no PoC, exploit code, patch, or proof of active exploitation.
CVE-2026-54130 Unauthenticated Information Disclosure in Microsoft 365 C... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-54130 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The post announces CVE-2026-54130, an unauthenticated information disclosure vulnerability in Microsoft 365, and points to a Vulmon link for more details.
🚨*CVE* CVE-2026-54130 Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network. https://www.cve.org/CVERecord?id=CVE-2026-54130 ----- Traducción: CVE-2026-54130 Falta de autenticación para una función… http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-54130, stating that missing authentication in a critical M365 Copilot function allows unauthorized information disclosure, with no PoC, exploit, patch, or evidence of active exploitation.
CVE-2026-54130 Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network. https://www.cve.org/CVERecord?id=CVE-2026-54130
Post summary
A newly disclosed CVE (CVE-2026-54130) targets missing authentication in M365 Copilot, potentially allowing information disclosure. No exploit, patch, or active exploitation details are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | microsoft | 365_copilot | - | - | - |