This vulnerability (CVE-2026-26164) in Microsoft 365 Copilot's Business Chat is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, i.e., Injection). It allows an attacker to perform command injection due to improper sanitization of special elements in commands processed by the service. Exploitation can lead to unauthorized information disclosure over a network. The vulnerability affects the cloud service, and Microsoft has issued an official fix. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality impact but no integrity or availability impact. The vendor manages remediation for this cloud-hosted service.

An attacker can exploit this vulnerability remotely without authentication or user interaction to disclose sensitive information over the network. The impact is limited to confidentiality, with no direct integrity or availability effects reported. Since the service is cloud-hosted, the risk is mitigated by vendor-side patching.

Microsoft has released an official fix for this vulnerability and manages remediation for the cloud-hosted Microsoft 365 Copilot service. Users and administrators should ensure their service instances are updated according to Microsoft's guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26164. No additional user action is required beyond applying the official fix.