This vulnerability (CVE-2026-21521) in Microsoft 365 Word Copilot is classified as CWE-150 (Improper Neutralization of Escape, Meta, or Control Sequences). It enables an unauthorized attacker to disclose sensitive information over a network by exploiting insufficient neutralization of control sequences. The vulnerability has a CVSS 3.1 base score of 7.4, indicating high severity with network attack vector, low attack complexity, no privileges required, and user interaction required. The scope is changed, and the impact is high confidentiality loss without integrity or availability impact. Microsoft has released an official fix and manages remediation for this cloud-hosted service. The vendor advisory is available at the Microsoft Security Response Center.

Successful exploitation can lead to unauthorized disclosure of sensitive information over the network. There is no impact on integrity or availability. The vulnerability affects confidentiality with a high severity rating. No known exploits are currently reported in the wild.

Microsoft has provided an official fix for this vulnerability and manages remediation for the cloud-hosted Microsoft 365 Word Copilot service. Users and administrators should ensure that their Microsoft 365 services are updated as per Microsoft's guidance. Check the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21521 for the latest remediation details and confirmation of patch deployment status.