---
id: 2026-07-microsoft-copilot-patch-tuesday-cves
title: "Microsoft July 2026 Patch Tuesday — GitHub Copilot JetBrains plugin CVE-2026-50510 + M365 Copilot mobile CVE-2026-48561 + M365 Copilot cross-tenant EoP CVE-2026-41106 + M365 Copilot RCE CVE-2026-50517 + VS Code Copilot credential leak CVE-2026-47282 (all patched)"
date_disclosed: 2026-07-14
last_updated: 2026-07-29
severity: critical
status: patched
ecosystems: [github-copilot, m365-copilot]
tools_affected: [github-copilot-jetbrains, microsoft-365-copilot-ios, microsoft-365-copilot-android, edge-android, microsoft-365-copilot, vscode]
tags: [cve, patch-tuesday, github-copilot, microsoft-365-copilot, prompt-injection, jetbrains, cross-tenant, deserialization, rce, credential-leak, vscode]
---

## TL;DR
Microsoft's **July 2026 Patch Tuesday** (2026-07-14, 622 CVEs total — the largest single Patch Tuesday on record) shipped fixes for three unrelated Copilot-family flaws: **CVE-2026-50510** (CVSS 7.8) — the **GitHub Copilot plugin for JetBrains IDEs** mishandled resource names (CWE-641) in a way that, with user interaction, allows full local compromise; **CVE-2026-48561** (CVSS 9.6) — **Microsoft 365 Copilot for iOS/Android**, reachable via **Microsoft Edge for Android**, would silently accept and act on prompts injected by a malicious website with no confirmation and no origin check; and **CVE-2026-41106** (CVSS 9.3, critical) — an **elevation-of-privilege flaw in Microsoft 365 Copilot itself** where a URL-redirection-to-untrusted-site weakness (CWE-601) could let an attacker cross tenant-isolation boundaries. A fourth, unrelated CVE published over a week later on **2026-07-23** — **CVE-2026-50517** (CVSS **9.9**, the highest in this batch) — is a deserialization-of-untrusted-data flaw in Microsoft 365 Copilot allowing unauthenticated-adjacent remote code execution with no user interaction. All four are cloud-service or client fixes with no reported in-the-wild exploitation. No action needed beyond updating clients (the two service-side CVEs, 41106 and 50517, required/require zero customer action) — but all four are useful reminders that "Copilot" now spans multiple, independently-vulnerable surfaces (IDE plugin, mobile app, browser integration, core cloud service) that each need their own security tracking.

## What happened

### CVE-2026-50510 — GitHub Copilot JetBrains plugin
An improper restriction of names for files/resources (CWE-641) in the **GitHub Copilot plugin for JetBrains IDEs** (IntelliJ IDEA, PyCharm, WebStorm, Rider, Android Studio, and others) allows an attacker who can get a developer to interact with malicious content — a repository, a pull request, or a package — to achieve full compromise of confidentiality, integrity, and availability on the local machine. It requires local access and user interaction (not remotely exploitable on its own), consistent with content-based attack chains this repo has tracked elsewhere (a poisoned repo/PR is the delivery vector, same shape as [GuardFall](2026-06-guardfall-shell-injection-agents.md) and [IDEsaster](2026-06-idessaster-ai-ide-cve-cluster.md)). **All plugin versions before 1.13.0-251 are affected; fixed in 1.13.0-251.**

### CVE-2026-48561 — Microsoft 365 Copilot mobile, via Edge for Android
Independent researcher **Ofek Levin of Enclave** found that Microsoft 365 Copilot's mobile apps (iOS and Android) would accept prompts delivered through **Microsoft Edge for Android** without confirming where they came from. A malicious website, visited in Edge on Android, could silently issue crafted prompts to Copilot — reading or modifying the victim's data with no click beyond visiting the page and no visible confirmation dialog. Microsoft rated this **CVSS 9.6 (critical)** and confirmed it was **never exploited in the wild**, with exploitation assessed as unlikely. Fixed the same day (2026-07-14); Edge for Android ≥ **150.0.4078.65** (released 2026-07-13) closes the vector, alongside the Copilot app updates.

This is a **different flaw** from this repo's already-tracked **[Microsoft 365 Copilot SearchLeak](2026-06-copilot-searchleak-cve-2026-42824.md)** (CVE-2026-42824, a `q=`-parameter-to-prompt-injection chain exfiltrating email/OneDrive data via a CSP/Bing-SSRF bypass, patched 2026-06-15) — but it's the same recurring class this repo flagged when writing up SearchLeak: **treating a URL, query parameter, or cross-app message as a trusted user prompt rather than untrusted input.** Two distinct CVEs against two distinct M365 Copilot surfaces in five weeks is a pattern worth tracking, not a coincidence.

### CVE-2026-41106 — Microsoft 365 Copilot cross-tenant elevation of privilege (update 2026-07-21)
A **critical (CVSS 9.3)** elevation-of-privilege flaw in the core Microsoft 365 Copilot service itself: a URL-redirection-to-untrusted-site weakness (CWE-601) undermined tenant-isolation trust boundaries. Reporting describes an authenticated attacker with some existing M365 access potentially able to reach Copilot's integrations with SharePoint and Entra ID to access data across organizational (tenant) boundaries — a third, distinct Copilot-family CVE from the same July 14 Patch Tuesday batch that this advisory hadn't originally captured. This is a **cloud-service-side fix**: Microsoft applied the patch on its own infrastructure, so **no customer action is required** and there is no client version to check. Microsoft reports no evidence of in-the-wild exploitation.

### CVE-2026-50517 — Microsoft 365 Copilot remote code execution via deserialization (update 2026-07-25)
Published **2026-07-23** (confirmed on [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-50517)) — the highest-severity Copilot-family flaw tracked in this advisory: **CVSS 9.9**, a deserialization-of-untrusted-data weakness (CWE-502) in Microsoft 365 Copilot that Microsoft's own advisory describes as letting an "authorized attacker" execute code over the network with no user interaction required. This is a **separate CVE from the July 14 Patch Tuesday batch above** — it published over a week later and is not part of that batch. Like CVE-2026-41106, this is an "exclusively-hosted service" flaw: Microsoft owns the fix server-side, and as of this writing has not published a detailed remediation statement or confirmed the patch is fully deployed, so treat any M365 Copilot deployment as the responsibility of Microsoft's own rollout rather than something a customer can directly verify. No PoC or in-the-wild exploitation has been reported.

### CVE-2026-47282 — VS Code / GitHub Copilot sign-in token disclosure (update 2026-07-29)
A fifth Copilot-family flaw from the same July 14 Patch Tuesday batch this advisory hadn't previously captured: **insufficiently protected credentials** (CWE-522) in **Visual Studio Code and GitHub Copilot** could disclose a user's **sign-in access token** to an unauthorized attacker over a network. Microsoft rates it **CVSS 3.1 base score 6.5 (medium)** — lower than the other four flaws in this advisory — and exploitation requires the victim to be enticed into opening a malicious file in VS Code (local-vector, user-interaction-required, not a zero-click flaw). Published 2026-07-14 alongside the JetBrains-plugin CVE; **affects VS Code versions before 1.128.1**, fixed in **1.128.1**. A leaked sign-in token could grant an attacker the same data/service access the victim's account has, so treat it with the same urgency as any other credential-disclosure bug even though the CVSS band is lower than its Patch Tuesday siblings.

## Am I affected?
- **GitHub Copilot JetBrains plugin:** check your plugin version in `Settings → Plugins → GitHub Copilot`. If it's below **1.13.0-251**, update immediately.
- **Microsoft 365 Copilot mobile / Edge for Android:** update both apps from your platform's app store. Confirm Edge for Android is **≥ 150.0.4078.65**.
- **Microsoft 365 Copilot (CVE-2026-41106, CVE-2026-50517):** no client-side action possible or needed for either — both are cloud-service-side fixes. If you operate a multi-tenant M365 environment, this is a good prompt to review Copilot permission scopes, SharePoint external-sharing settings, and Entra ID cross-tenant access policies as defense-in-depth, and to watch the MSRC advisory page for confirmation that CVE-2026-50517's fix has fully rolled out.
- **VS Code / GitHub Copilot (CVE-2026-47282):** check `Help → About` in VS Code. If it's below **1.128.1**, update — and avoid opening untrusted files in VS Code until you do.

None of the five flaws has a known IOC set or confirmed in-the-wild exploitation — there's no forensic triage step beyond confirming you're on the patched client versions (and, for the two cloud-service-side CVEs, nothing to confirm at all).

## If you are affected
Update is the fix for the two client-side CVEs; there is no rotation or containment step required since Microsoft reports no exploitation occurred for any of the four, and the two cloud-service-side CVEs (CVE-2026-41106, CVE-2026-50517) required no customer action in the first place.

## Prevention
→ [prevention/package-vetting-checklist.md](../prevention/package-vetting-checklist.md) — for the JetBrains plugin flaw, the same discipline that applies to any "don't blindly open unfamiliar repos/PRs in an AI-integrated IDE" guidance applies here.
→ [prevention/agent-sandboxing.md](../prevention/agent-sandboxing.md) — treat any AI assistant reachable from a mobile browser or cross-app message channel as attacker-reachable input, not just chat-box input.

## Why this matters for vibe coders
"GitHub Copilot" and "Microsoft 365 Copilot" are different products with different attack surfaces, and both had CVEs land in the same Patch Tuesday — a useful reminder to patch every Copilot-branded surface you use (IDE plugin, desktop, mobile, browser integration) independently rather than assuming one update covers them all.

## Sources
- [Windows News — A high-risk Copilot flaw can hijack your JetBrains IDE, Microsoft urges immediate patch](https://windowsnews.ai/article/a-high-risk-copilot-flaw-can-hijack-your-jetbrains-ide-microsoft-urges-immediate-patch.438594)
- [Windows News — July Patch Tuesday: Visual Studio Code update to fix security feature bypass and more](https://windowsnews.ai/article/july-patch-tuesday-update-visual-studio-code-now-to-fix-security-feature-bypass-and-more.438185)
- [NotebookCheck — Microsoft Copilot: Websites could secretly issue commands to the AI](https://www.notebookcheck.net/Microsoft-Copilot-Websites-could-secretly-issue-commands-to-the-AI.1343346.0.html)
- [Windows News — Microsoft flags CVE-2026-41106: Copilot privilege escalation could cross tenant boundaries](https://windowsnews.ai/article/microsoft-flags-cve-2026-41106-copilot-privilege-escalation-could-cross-tenant-boundaries.433548)
- [SOCRadar — July 2026 Patch Tuesday: 622 Vulnerabilities, 3 Zero-Days](https://socradar.io/blog/july-2026-patch-tuesday-zero-day/)
- [NVD — CVE-2026-50517](https://nvd.nist.gov/vuln/detail/CVE-2026-50517) — canonical CVE record: CVSS 9.9, CWE-502 deserialization, publish date 2026-07-23.
- [Windows News — Microsoft 365 Copilot RCE Flaw Confirmed: Steps Every Admin Should Take Today](https://windowsnews.ai/article/microsoft-365-copilot-rce-flaw-confirmed-steps-every-admin-should-take-today.440229) — independent corroboration and admin-response guidance for CVE-2026-50517.
- [MSRC — CVE-2026-47282](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47282) — canonical vendor record for the VS Code/GitHub Copilot credential-disclosure flaw.
- [Windows Forum — CVE-2026-47282: Update VS Code to 1.128.1 to Protect Copilot Credentials](https://windowsforum.com/threads/cve-2026-47282-update-vs-code-to-1-128-1-to-protect-copilot-credentials.438181/) — independent corroboration of affected/patched version and CVSS 6.5 rating.