This vulnerability (CVE-2026-24307) in Microsoft 365 Copilot arises from improper validation of input types, classified under CWE-1287. Exploitation can lead to unauthorized information disclosure over a network. The CVSS 3.1 score of 9.3 reflects network attack vector, low attack complexity, no privileges required, but user interaction needed, with complete confidentiality and integrity impact and no availability impact. The vulnerability is officially published and a patch is available, though no specific patch links are provided in the data.

An attacker who successfully exploits this vulnerability can disclose sensitive information over the network without requiring privileges, potentially compromising confidentiality and integrity of data processed by Microsoft 365 Copilot. There is no indication of impact on system availability. No known exploits are reported in the wild at this time.

A patch is available for this vulnerability and should be applied promptly to mitigate the risk. Since this is not a cloud service, organizations must ensure their Microsoft 365 Copilot installations are updated with the official fix once it is obtained from Microsoft. Monitor vendor advisories for patch release details and deployment instructions.