This vulnerability (CVE-2026-26129) is classified as CWE-138, indicating improper neutralization of special elements used in commands within Microsoft 365 Copilot's Business Chat. The flaw allows an attacker to perform command injection that can disclose sensitive information over the network. The CVSS v3.1 score is 7.5 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. Microsoft has issued an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild at this time.

An attacker can remotely exploit this vulnerability without authentication or user interaction to disclose sensitive information from Microsoft 365 Copilot's Business Chat. The integrity and availability of the service are not impacted. The vulnerability could lead to unauthorized information disclosure over the network.

Microsoft has released an official fix for this vulnerability and manages remediation for the cloud-hosted Microsoft 365 Copilot service. Customers should ensure their service instances are updated per Microsoft's guidance available in the vendor advisory. No additional customer action is required beyond applying the official fix as managed by Microsoft.