This vulnerability (CWE-601) in Microsoft 365 Copilot involves an open redirect flaw where URLs can be manipulated to redirect users to untrusted external sites. This can be exploited by unauthorized attackers to elevate privileges within the network context. The vulnerability is remotely exploitable without privileges and requires user interaction. Microsoft manages remediation for this cloud service and has released an official fix to address the issue.

Successful exploitation can lead to privilege escalation and compromise of confidentiality and integrity within affected environments. Availability is not impacted. The vulnerability is rated critical with a CVSS score of 9.3, reflecting its severity and ease of exploitation.

Microsoft has released an official fix for this vulnerability in Microsoft 365 Copilot. As this is a cloud service, Microsoft manages the remediation server-side. Administrators and users should ensure their Microsoft 365 Copilot service is updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33102. No additional mitigation actions are required beyond applying the official fix.