Microsoft 365 Copilot CVE-2026-78501

Exploitation requires the attacker to be able to supply input that Microsoft 365 Copilot Business Chat processes - i.e. the target organization must have Copilot Business Chat (the enterprise 'work' grounded chat) enabled and reachable. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and low complexity against the service as deployed by Microsoft. The injection depends on the service failing to neutralize special elements in attacker-supplied content; the scope change (S:C) implies the disclosed data crosses into a context beyond the attacker's own. Limiting factors: the product is a Microsoft-hosted SaaS, so exploitation and remediation are tied to Microsoft's cloud configuration rather than a customer-installed version, and organizations that have not enabled Copilot Business Chat are not exposed. CISA SSVC marks exploitation as non-automatable, suggesting it is not trivially mass-exploitable.

Signals are moderately conflicting and point to a real-but-not-urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6) describes a network-reachable, unauthenticated, low-complexity flaw with a scope change and HIGH confidentiality impact but NO integrity or availability impact - i.e. an information-disclosure issue, not code execution, despite the CWE-77/command-injection labeling. This CVSS-vs-description tension should be verified with Microsoft: the title says 'command injection' yet I:N/A:N indicate the attacker reads data rather than altering state or running arbitrary commands with persistence. The remaining signals temper the high base score: EPSS is only 0.49% (41st percentile), the vulnerability is NOT in CISA KEV, and CISA SSVC records Exploitation=none, Automatable=no, Technical Impact=partial. The low EPSS and non-automatable SSVC are consistent with each other and suggest no widespread opportunistic exploitation is expected. Because the affected product is a Microsoft-operated SaaS (Microsoft 365 Copilot), remediation is largely vendor-side cloud mitigation rather than customer patching, which further lowers operational urgency for most defenders. Net: treat as a standard-priority confidentiality issue to track, not a drop-everything emergency - but confirm the actual technical impact and command-injection semantics directly with the MSRC advisory.

A remote, unauthenticated attacker crafts malicious input (e.g. content or a prompt processed by Microsoft 365 Copilot Business Chat) containing improperly neutralized special elements that the backend interprets as a command, causing Copilot to return or leak information the attacker should not be able to access. Because the CVSS scope is Changed, the disclosed data may belong to a different security context (e.g. another user or component) than the one the attacker controls. No public exploit code has been identified, and CISA SSVC rates exploitation as none and non-automatable.