This vulnerability (CVE-2026-24307) in Microsoft 365 Copilot arises from improper validation of input types, which can be exploited by an unauthorized attacker to disclose information over a network. The CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality and integrity. Microsoft manages remediation for this cloud-hosted service and has released an official fix as detailed in their advisory.

An attacker who successfully exploits this vulnerability can disclose sensitive information over the network without requiring privileges, potentially compromising confidentiality and integrity of data processed by Microsoft 365 Copilot. The vulnerability does not impact availability. The scope of the vulnerability is changed, meaning it can affect resources beyond the initially vulnerable component.

Microsoft has released an official fix for this vulnerability in Microsoft 365 Copilot. As this is a cloud service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Copilot service is updated according to Microsoft's guidance in the official advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24307. No additional user action is required beyond applying the official fix.