Product:
M365 Copilot
Summary
Url redirection to untrusted site in M365 Copilot allows an unauthorized attacker to elevate privileges over a network. This vulnerability can lead to significant security risks, including unauthorized access to sensitive information. Attackers can exploit this flaw to redirect users to malicious sites.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.3 | CVE-2026-33102 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious URL that redirects users to an untrusted site. This requires user interaction, as the victim must click on the link. Once the user is redirected, the attacker can potentially gain elevated privileges and access sensitive data over the network.
Affected Products
- M365 Copilot: A productivity tool that integrates with Microsoft 365 applications, allowing users to enhance their workflow.
Mitigation
To mitigate this vulnerability, users should ensure that they do not click on untrusted links and should verify the authenticity of URLs before accessing them. Organizations should implement security measures such as URL filtering and user training to reduce the risk of exploitation.