This vulnerability (CWE-74) in Microsoft 365 Copilot's Business Chat arises from improper neutralization of special elements in output that is consumed by a downstream component, resulting in an injection vulnerability. The flaw enables an attacker to disclose sensitive information over a network without authentication or user interaction. The CVSS 3.1 base score is 7.5, reflecting high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Microsoft manages remediation for this cloud service and has released an official fix as documented in their security update guide.

An attacker can exploit this injection vulnerability remotely to disclose sensitive information over the network. The vulnerability does not allow integrity or availability impacts but compromises confidentiality. No known active exploits have been reported.

Microsoft has released an official fix for this vulnerability and manages remediation for the cloud-hosted Microsoft 365 Copilot service. Users and administrators should ensure their service is updated according to Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26164 to mitigate this issue.