Microsoft Copilot Chat CVE-2025-59286

Exploitation targets Microsoft 365 Copilot Chat specifically; the attacker must be able to send input to the Copilot Chat service over the network and supply content containing unneutralized special command elements that the service interprets. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no privileges, and no user interaction are required, and complexity is low, so there is no special configuration prerequisite stated. The main limiting factor is that this is a Microsoft-hosted cloud service: Microsoft controls the single deployment, so once the vendor remediates server-side the window closes for all tenants, and individual customers cannot be targeted via a locally misconfigured instance. The scope change (S:C) indicates the disclosed information can extend beyond the component the attacker directly interacts with.

Signals are mixed and point to a serious but not yet mass-exploited issue. The CVSS 3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) describes a network-reachable, low-complexity, unauthenticated flaw with a scope change and high confidentiality impact - a textbook high-priority profile. However, EPSS is only 0.57% (45th percentile), the CVE is NOT on the CISA KEV list, and no public PoC is referenced, so there is no evidence of active or imminent widespread exploitation. There is also a notable internal tension worth flagging: the CWE is CWE-77 ('command injection') and the title says command injection, yet the impact metrics are C:H/I:L/A:N (information disclosure with only limited integrity impact and no availability impact), which is atypical for classic OS command injection and is more consistent with an AI/prompt-injection-style flaw in the Copilot service that leaks data across a trust boundary (hence S:C) - verify the true technical nature with Microsoft before treating it as remote code execution. Critically, 365 Copilot Chat is a Microsoft-operated cloud/SaaS service, so the fix is almost certainly already deployed server-side by Microsoft and customers likely have no patching action; this materially lowers the practical, ongoing risk to a given tenant despite the high nominal score. Net assessment: a genuinely high-severity design/injection flaw that warranted an urgent vendor fix, but current real-world risk to customers is moderated by SaaS remediation and the absence of KEV/PoC/high-EPSS exploitation signals.

An unauthenticated remote attacker crafts input containing special command elements that the 365 Copilot Chat service fails to neutralize, causing the service to process the injected instructions and return information the attacker should not be able to access. Because the scope is changed (S:C), the disclosed data can cross a trust boundary (e.g., other context or tenant resources) rather than being limited to the attacker's own session. No public exploit code is identified at time of analysis, and the attack requires no privileges or user interaction per the CVSS vector.