This vulnerability, identified as CWE-138, involves improper neutralization of special elements used in commands within Microsoft 365 Copilot's Business Chat feature. An attacker can exploit this command injection flaw to disclose sensitive information over a network without requiring privileges or user interaction. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity. Microsoft manages remediation for this cloud service and has released an official fix. Users should refer to the Microsoft Security Response Center advisory for patch application details.

Successful exploitation can lead to unauthorized information disclosure over the network. There is no impact on integrity or availability reported. The vulnerability does not require privileges or user interaction to exploit, increasing its risk. However, no active exploits have been observed in the wild.

Microsoft has released an official fix for this vulnerability and manages remediation for the cloud-hosted Microsoft 365 Copilot service. Administrators and users should follow the guidance in the Microsoft Security Response Center advisory to ensure the service is updated and protected. No additional mitigation actions are required beyond applying the official fix.