This vulnerability (CVE-2026-26136) in Microsoft Copilot involves improper neutralization of special elements used in commands, classified as CWE-77 (command injection). It enables unauthorized attackers to disclose sensitive information over a network without requiring privileges but does require user interaction. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality impact. Microsoft has published an official fix for this vulnerability.

An attacker can exploit this vulnerability to disclose sensitive information over a network. The confidentiality impact is high, but integrity and availability are not affected. The attack requires user interaction but no privileges, and can be performed remotely.

An official fix is available from Microsoft. Users and administrators should apply the patch provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26136 to remediate this vulnerability.