Product:
M365 Copilot
Summary
Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network. This vulnerability can lead to significant confidentiality and integrity impacts. Attackers can exploit this flaw to gain unauthorized access to sensitive information.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.3 | CVE-2026-24307 |
Exploitation
To exploit this vulnerability, an attacker must have network access and must interact with the M365 Copilot application. By providing specially crafted input that bypasses validation checks, the attacker can trigger the information disclosure, potentially exposing sensitive data to unauthorized parties.
Affected Products
- M365 Copilot: Affected by improper input validation leading to potential information disclosure.
Mitigation
To mitigate this vulnerability, users should ensure that they are using the latest version of M365 Copilot and apply any available security updates. Additionally, organizations should implement network security measures to limit unauthorized access to the application.