This vulnerability (CWE-601) in Microsoft 365 Copilot involves URL redirection to untrusted sites ('open redirect'). An attacker can exploit this flaw to elevate privileges over a network, potentially impacting confidentiality and integrity. The vulnerability is rated critical with a CVSS 3.1 base score of 9.3, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality and integrity. Microsoft has released an official fix and, as a cloud service, remediation is managed by Microsoft.

Successful exploitation can lead to privilege escalation and compromise of confidentiality and integrity within the affected environment. Availability is not impacted. The vulnerability allows attackers to redirect users to malicious sites, potentially facilitating further attacks or unauthorized access.

Microsoft has released an official fix for this vulnerability and manages remediation for Microsoft 365 Copilot as a cloud service. Users and administrators should ensure that the service is updated according to Microsoft's guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33102. No additional action is required beyond applying the official fix.