Product:
M365 Copilot
Summary
Improper neutralization of special elements in M365 Copilot allows an unauthorized attacker to disclose information over a network. This vulnerability can lead to significant confidentiality issues as sensitive information may be exposed. Attackers can exploit this flaw without needing any privileges or user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2026-26129 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted requests to the M365 Copilot service over the network. By manipulating the input, the attacker can trigger the improper handling of special elements, leading to the disclosure of sensitive information. Since the attack complexity is low and does not require any privileges, it poses a significant risk.
Affected Products
- M365 Copilot: Vulnerable to information disclosure due to improper handling of special elements.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by Microsoft. Additionally, organizations should implement network security measures to monitor and restrict unauthorized access to the M365 Copilot service. Regular security assessments can also help identify and address potential vulnerabilities.