This vulnerability (CVE-2026-33102) is classified as CWE-601, an open redirect issue in Microsoft 365 Copilot. It allows unauthorized attackers to redirect users to untrusted external URLs, which can be leveraged to elevate privileges within a network context. The vulnerability is remotely exploitable without privileges and requires user interaction. The service is cloud-based, and Microsoft manages remediation through an official fix. The CVSS v3.1 score is 9.3, indicating critical severity with high impact on confidentiality and integrity but no impact on availability.

Successful exploitation could lead to significant confidentiality and integrity breaches by redirecting users to malicious sites that may facilitate privilege escalation. The vulnerability does not impact availability. No known active exploits have been reported.

Microsoft has released an official fix for this vulnerability and manages remediation for the cloud-hosted Microsoft 365 Copilot service. Users and administrators should ensure that their Microsoft 365 Copilot service is updated according to Microsoft's guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33102. No additional mitigation actions are required beyond applying the official fix.