Microsoft Copilot In Azure
Monthly
Server-side request forgery in Microsoft Copilot in Azure enables any authenticated Azure user to coerce the service into issuing arbitrary outbound requests, disclosing internal or cloud-infrastructure data back through the Copilot response channel. The CVSS scope-change indicator (S:C) and high confidentiality impact (C:H) suggest the service's privileged network position can be leveraged to reach resources beyond the application boundary - such as Azure Instance Metadata Service endpoints, internal APIs, or adjacent cloud services. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; Microsoft has released a server-side patch.
Server-side request forgery in Microsoft Copilot in Azure enables any authenticated Azure user to coerce the service into issuing arbitrary outbound requests, disclosing internal or cloud-infrastructure data back through the Copilot response channel. The CVSS scope-change indicator (S:C) and high confidentiality impact (C:H) suggest the service's privileged network position can be leveraged to reach resources beyond the application boundary - such as Azure Instance Metadata Service endpoints, internal APIs, or adjacent cloud services. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; Microsoft has released a server-side patch.