M365 Copilot For Desktop
Monthly
Improper access control in M365 Copilot for Desktop (all versions before 19.2604.43111.0) enables a local attacker without system privileges to perform identity spoofing, resulting in high confidentiality impact with no integrity or availability consequences. The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires only local access - no authentication, elevated privileges, or user interaction is needed. No public exploit code has been identified; EPSS stands at 0.04% (12th percentile) and SSVC designates exploitation as 'none,' placing this firmly in the category of a patched but currently low-threat-activity vulnerability.
Improper access control in M365 Copilot for Desktop (all versions before 19.2604.43111.0) enables a local attacker without system privileges to perform identity spoofing, resulting in high confidentiality impact with no integrity or availability consequences. The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires only local access - no authentication, elevated privileges, or user interaction is needed. No public exploit code has been identified; EPSS stands at 0.04% (12th percentile) and SSVC designates exploitation as 'none,' placing this firmly in the category of a patched but currently low-threat-activity vulnerability.