Microsoft 365 Copilot CVE-2026-26164

Remote unauthenticated exploitation against Microsoft 365 Copilot Business Chat in default configurations. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no special prerequisites - any network-connected attacker can attempt exploitation without authentication or user interaction. However, successful information disclosure depends on the target organization having Microsoft 365 Copilot Business Chat enabled in their tenant and accessible from the attacker's network location. Organizations that have not enabled Copilot features, have restricted Copilot to specific user groups via licensing policies, or have disabled external access to Microsoft 365 services through conditional access policies may not be exploitable. The injection's effectiveness also depends on what data sources (SharePoint, Exchange, Teams, etc.) are configured for Copilot indexing in the target tenant.

Real-world risk is elevated but nuanced. CVSS 7.5 with AV:N/AC:L/PR:N/UI:N indicates trivial exploitation - any network-connected attacker can attempt exploitation without authentication or user interaction. The scope is unchanged (S:U), meaning impact is contained to the vulnerable component's authorization context, but confidentiality impact is high (C:H). No EPSS score provided, and absence from CISA KEV suggests no confirmed widespread exploitation. However, the combination of unauthenticated network access, low complexity, and the high-value target nature of Microsoft 365 Copilot data makes this attractive for reconnaissance and data exfiltration campaigns. Organizations using Copilot Business Chat in environments with sensitive data should prioritize patching. The CVSS temporal metrics (E:U/RL:O/RC:C) confirm official patch availability with no current exploit code identified, reducing immediate urgency compared to actively exploited vulnerabilities but not eliminating risk given the ease of exploitation.

An external attacker crafts a malicious prompt containing injection payloads targeting Microsoft 365 Copilot's Business Chat interface. By submitting specially formatted queries through the Copilot web interface or integrated Microsoft 365 applications without authentication, the attacker manipulates how downstream components process the request. The injection causes Copilot to retrieve and disclose information from Microsoft Graph, SharePoint, or Exchange data sources beyond the attacker's authorization scope, potentially exposing organizational documents, emails, or user metadata. No proof-of-concept code is publicly identified, but the low attack complexity suggests straightforward exploitation once injection syntax is determined.