Microsoft Copilot in Azure CVE-2026-69855

Exploitation requires a valid Azure account with at minimum low-level access rights to Microsoft Copilot in Azure (PR:L per CVSS vector) - unauthenticated external attackers cannot exploit this vulnerability. No non-default feature configuration, specific deployment mode, or elevated privilege beyond standard Copilot access appears necessary, as attack complexity is rated Low (AC:L) and no user interaction is required (UI:N). The primary limiting factor is the authentication barrier (PR:L): exploitation is bounded to the authenticated Azure user population for the affected tenant, which in enterprise environments may still represent a large number of potential internal threat actors. The scope change (S:C) signals that reachable internal targets extend beyond the Copilot application itself, but the specific internal endpoints accessible depend on the network topology and policies of the Azure deployment. There is no integrity or availability impact (I:N/A:N), confining exploitation outcomes strictly to information disclosure.

The CVSS 7.7 High score is supported by a credible vector: AV:N (fully network-exposed), AC:L (no special conditions required beyond authentication), PR:L (any low-privilege Azure account suffices), UI:N (no victim interaction needed), S:C (scope change - forged requests reach external security domains), C:H (high confidentiality breach via disclosed internal data), I:N/A:N (integrity and availability unaffected). The scope change combined with C:H is the most consequential signal here, as Azure Copilot's internal network position may expose cloud metadata credentials or sensitive infrastructure responses. No EPSS data was included in available intelligence, limiting probabilistic exploitation forecasting. The absence of a CISA KEV listing and no identified public POC suggest exploitation is not yet widespread, but the low attack complexity means that any authenticated tenant user could realistically attempt this. Organizations with sensitive Azure-internal workloads accessible from Copilot's network context face meaningful information disclosure risk despite the lack of confirmed in-the-wild exploitation.

An attacker holding a low-privilege Azure account - such as a standard tenant user or a compromised service principal - submits crafted input to Microsoft Copilot in Azure that embeds a URL pointing to an Azure internal resource such as the Instance Metadata Service (http://169.254.169.254/metadata/instance) or an internal management API. The Copilot backend issues the forged request from its privileged internal network context, receives the response containing cloud metadata or credentials, and surfaces that data back to the attacker through the Copilot interface. No public POC has been confirmed, but the low complexity of basic SSRF input manipulation means this scenario requires no sophisticated tooling.