This vulnerability (CVE-2026-26129) involves improper neutralization of special elements (CWE-138) in Microsoft 365 Copilot's Business Chat, which can lead to unauthorized information disclosure over the network. The flaw requires no privileges or user interaction to exploit and affects the confidentiality of data. Microsoft has released an official fix and manages remediation for this cloud service. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting high confidentiality impact with network attack vector and low attack complexity.

An attacker can remotely exploit this vulnerability to disclose sensitive information from Microsoft 365 Copilot's Business Chat without authentication or user interaction. The impact is limited to confidentiality; integrity and availability are not affected. There are no reports of active exploitation in the wild.

Microsoft has released an official fix for this vulnerability and manages remediation for the cloud-hosted Microsoft 365 Copilot service. Users and administrators should ensure their service instances are updated according to Microsoft's guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26129. No additional mitigation actions are required beyond applying the official fix.