This vulnerability (CVE-2026-42827) in Microsoft 365 Copilot involves improper neutralization of special elements in commands, classified under CWE-77 (Command Injection). It enables unauthorized attackers to disclose information over a network without requiring privileges but does require user interaction. The vulnerability affects the cloud service, which Microsoft manages and patches server-side. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality impact with no integrity or availability impact. An official fix is available from Microsoft.

An attacker can exploit this vulnerability to disclose sensitive information over the network. The confidentiality impact is high, but there is no impact on integrity or availability. Exploitation requires user interaction but no privileges or authentication. No active exploitation has been reported.

Microsoft has released an official fix for this vulnerability and manages remediation for Microsoft 365 Copilot as a cloud service. Users and administrators should ensure their Microsoft 365 Copilot service is updated according to Microsoft's guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42827. No additional user action is required beyond applying the official fix.