Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-05-25 · source-backed
Microsoft disclosed a critical CVSS 8.6 vulnerability affecting M365 published agents. Improper access control lets unauthenticated attackers bypass permission boundaries, potentially gaining control over AI resources and the underlying M365 environment. Confirmed active exploitation in the wild. If you're running M365 agents, patch now.
Each link below shares sources, entities, or timing with this story.
Anthropic partners with Microsoft / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Anthropic partners with Microsoft); both cover CVSS, Microsoft; overlapping topics (access, attacker, bypass).
Microsoft competes with Google / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Microsoft competes with Google); both cover CVSS, Microsoft; overlapping topics (agent, confirmed).
Anthropic partners with Microsoft / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Anthropic partners with Microsoft); both cover M365, Microsoft; overlapping topics (agent, m365).
Microsoft supports MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Microsoft supports MCP); both cover CVSS, Microsoft; overlapping topics (access, azure).
Microsoft criticizes Semantic Kernel / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Microsoft criticizes Semantic Kernel); both cover CVSS, Microsoft; overlapping topics (agent, attacker).
Copilot Studio built by Microsoft / Shared entity: Microsoft / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Copilot Studio built by Microsoft); both cover Microsoft; overlapping topics (access, agent, azure).
Microsoft supports MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Microsoft supports MCP); both cover CVSS, Microsoft; overlapping topics (agent, azure).
Anthropic partners with Microsoft / Shared entities / Earlier coverage / Tension
Linked by a graph relationship (Anthropic partners with Microsoft); both cover CVSS, Microsoft; earlier CVSS coverage from 2026-03-23.