EUVD-2026-38091
GHSA-vwmm-7w98-r7p2
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable Copilot endpoint with no attacker auth (PR:N) but mandatory victim click (UI:R); redirect-to-token-theft chain credibly yields full CIA impact on the tenant account.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a network.
AnalysisAI
Privilege elevation in Microsoft 365 Copilot's Business Chat is possible when an attacker abuses an open redirect (CWE-601) to coerce a victim into following a crafted link that lands on an attacker-controlled site. With a CVSS 3.1 base score of 8.8 and high impact across confidentiality, integrity, and availability, successful exploitation lets an unauthorized remote attacker elevate privileges over the network after user interaction. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
The flaw lives in the Business Chat surface of Microsoft 365 Copilot, an AI assistant integrated into the Microsoft 365 productivity suite that grounds responses on tenant data via the Microsoft Graph. CWE-601 (URL Redirection to Untrusted Site) describes a class of bug where a server-side component accepts a URL parameter and redirects the user to it without validating that the destination is on an allow-listed host. In a Copilot context, rendered citations, action links, or chat-surfaced URLs that pass through a redirector can be manipulated so the trusted Microsoft domain bounces the victim to an attacker-controlled origin, which can then phish credentials, harvest OAuth tokens, or chain into further account/privilege takeover - the mechanism Microsoft characterizes as elevation of privilege here.
RemediationAI
Patch available per vendor advisory - because Microsoft 365 Copilot Business Chat is a cloud service, Microsoft deploys the fix server-side and tenants do not need to install an update; administrators should confirm remediation status against the MSRC entry at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47645. As compensating controls, enforce Conditional Access and phishing-resistant MFA on accounts with Copilot licenses so that even a successful redirect-to-phish flow cannot complete authentication, train users that legitimate Copilot citations should resolve to known Microsoft 365 domains, and consider Defender for Office 365 Safe Links policies that re-scan URLs at click-time so post-fix variants are caught (side effect: Safe Links can break some legitimate deep links and adds redirect latency).
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today