This vulnerability, identified as CVE-2026-33102 and classified under CWE-601 (URL Redirection to Untrusted Site), affects Microsoft 365 Copilot. It allows an attacker to exploit an open redirect flaw to redirect users to malicious sites, which can lead to privilege escalation within the network context. The vulnerability is remotely exploitable without privileges and requires user interaction. Microsoft manages remediation for this cloud service and has released an official fix.

Successful exploitation of this vulnerability can lead to an attacker elevating privileges over a network by redirecting users to untrusted sites, potentially compromising confidentiality and integrity of data. The CVSS score of 9.3 reflects critical impact on confidentiality and integrity, with no impact on availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft, and since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should ensure that the Microsoft 365 Copilot service is updated according to Microsoft's guidance. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33102 for detailed remediation instructions.