Product
Microsoft Security Updates — July 2026
11 CVEs 354 IOCsRoundup of Microsoft security advisories published in July 2026.
Microsoft 365 Copilot Multiple Vulnerabilities
2 rules 2 TTPsA remote, anonymous attacker can exploit multiple vulnerabilities in Microsoft 365 Copilot to execute arbitrary program code and disclose confidential information.
Multiple Vulnerabilities in Microsoft Cloud Products Allow Privilege Escalation and Code Execution
3 rules 3 TTPs 5 CVEsMultiple vulnerabilities in Microsoft Azure, Microsoft 365 Copilot, Microsoft Dynamics 365, and Microsoft Power Apps could allow an attacker to escalate privileges, execute arbitrary code, and conduct spoofing attacks.
M365 Copilot Impersonation Jailbreak Attempt Detection
2 rules 1 TTPThis detection identifies M365 Copilot impersonation and roleplay jailbreak attempts by analyzing exported eDiscovery prompt logs, searching for users manipulating the AI into adopting alternate personas or bypassing safety controls via roleplay keywords, categorizing specific impersonation types to identify persona injection attacks.
M365 Copilot Application Usage Pattern Anomalies
2 rules 1 TTPThis detection identifies anomalous M365 Copilot usage patterns indicative of potential account compromise or automated abuse by flagging users accessing Copilot from multiple locations, generating excessive daily activity, or utilizing multiple Copilot applications.
Microsoft 365 Copilot Jailbreak Attempts via Prompt Injection
2 rules 1 TTPThis detection identifies Microsoft 365 Copilot jailbreak attempts by detecting prompt injection techniques within exported eDiscovery prompt logs to circumvent built-in safety controls.
Detection of M365 Copilot Jailbreak Attempts via Prompt Injection
2 rules 1 TTPThis detection identifies attempts to jailbreak M365 Copilot by using prompt injection techniques to bypass safety controls and manipulate system behavior, potentially violating acceptable use policies.