This vulnerability in Microsoft Copilot Studio is due to improper neutralization of special elements in commands, leading to potential command injection issues. An unauthenticated attacker can exploit this flaw over the network to gain unauthorized access to sensitive information. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact. Microsoft has published an official fix to address this issue.

An unauthenticated attacker can remotely access sensitive information in Microsoft Copilot Studio without requiring privileges or user interaction. The confidentiality impact is high, while integrity and availability are not affected. This exposure could lead to data leakage and compromise of sensitive data handled by the affected product.

An official fix is available from Microsoft. Users and administrators should apply the provided patch as soon as possible to remediate this vulnerability. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21520 for detailed patching instructions.