This vulnerability (CVE-2026-24299) in Microsoft 365 Copilot involves improper neutralization of special elements in commands, classified as CWE-77 (Command Injection). It enables unauthorized attackers to disclose sensitive information over a network. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, no integrity or availability impact, and an official fix is available. As a cloud service, Microsoft manages remediation server-side.

An attacker exploiting this vulnerability can disclose sensitive information over the network without requiring privileges but needs user interaction. The confidentiality impact is high, while integrity and availability are not affected. There are no known exploits in the wild at this time.

Microsoft has released an official fix for this vulnerability and manages remediation for Microsoft 365 Copilot as a cloud-hosted service. Users should ensure their service is updated according to Microsoft's guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24299. No additional user action is required beyond applying the official fix.