Product:
Microsoft 365 Copilot
Summary
Server-side request forgery in Microsoft 365 Copilot’s Business Chat allows an authorized attacker to elevate privileges over a network. This vulnerability can lead to unauthorized access and manipulation of sensitive data. It poses a significant risk due to its high severity rating.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.9 | CVE-2026-26137 |
Exploitation
To exploit this vulnerability, an attacker must be authorized and interact with the Business Chat feature of Microsoft 365 Copilot. By crafting specific requests, the attacker can manipulate the server to perform actions on behalf of the user, potentially gaining elevated privileges and accessing restricted resources.
Affected Products
- Microsoft 365 Copilot: A productivity tool that integrates AI capabilities into Microsoft 365 applications, allowing users to enhance their workflows.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by Microsoft. Additionally, organizations should implement strict access controls and monitor network traffic for any suspicious activities related to the Business Chat feature.