Microsoft 365 Copilot CVE-2026-26129

No special conditions - remote unauthenticated exploitation against default configurations of Microsoft 365 Copilot's Business Chat. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network accessibility with low complexity, no privileges required, and no user interaction needed. Organizations with M365 Copilot Business Chat enabled and accessible from the internet are vulnerable. The only limiting factor is that the target organization must have an active M365 Copilot subscription with Business Chat feature deployed, which is not universally present across all Microsoft 365 tenants and requires explicit licensing and enablement by administrators.

This presents genuine risk due to the combination of network attack vector (AV:N), no authentication required (PR:N), low attack complexity (AC:L), and high confidentiality impact (C:H). The CVSS 7.5 score accurately reflects the ease of exploitation and potential for sensitive data disclosure. However, several factors moderate real-world urgency: no confirmed active exploitation (not in CISA KEV), no public exploit identified at time of analysis, and vendor patch already available (RL:O). The CVSS temporal metrics (E:U, RL:O, RC:C) reduce the environmental score from 7.5 to approximately 6.7. The zero privileges required (PR:N) is particularly concerning for an enterprise AI tool that may have access to confidential business communications and documents. Organizations using M365 Copilot's Business Chat in production should prioritize patching, as the combination of network accessibility and high confidentiality impact creates realistic risk of unauthorized data access, even without evidence of active exploitation. The lack of integrity or availability impact (I:N/A:N) limits this to a disclosure-only scenario, preventing lateral movement or system compromise through this vector alone.

An external attacker crafts specially formatted queries containing control characters or injection payloads and submits them to an organization's M365 Copilot Business Chat endpoint over the public internet without authentication. The improper input neutralization allows the malicious payload to bypass access controls or manipulate the AI model's response generation, causing Copilot to disclose sensitive business data from SharePoint, OneDrive, Exchange, or Teams that the attacker should not have access to. The attacker exfiltrates confidential documents, customer information, or internal communications through repeated crafted queries.