This vulnerability, identified as CWE-74, involves improper neutralization of special elements in commands processed by Microsoft 365 Copilot's Business Chat, resulting in command injection. An attacker can exploit this flaw to disclose sensitive information over a network without requiring privileges or user interaction. The vulnerability affects the cloud service, and Microsoft has released an official fix to address it.

An unauthorized attacker can exploit this vulnerability remotely to disclose sensitive information over the network. There is no impact on integrity or availability reported. The vulnerability does not require privileges or user interaction, increasing its risk. No known exploits are currently in the wild.

Microsoft manages remediation for this cloud-hosted service and has released an official fix. Users should follow the guidance in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26164 to ensure their environment is updated. No additional action is required beyond applying the official fix.