This vulnerability (CVE-2026-42827) in Microsoft 365 Copilot involves improper neutralization of special elements used in commands, classified under CWE-77 (Command Injection). An attacker could leverage this weakness to disclose sensitive information over a network without requiring privileges, though user interaction is needed. The vulnerability is rated medium severity with a CVSS 3.1 score of 6.5. Microsoft, as the vendor of this cloud service, has released an official fix and manages remediation server-side. No active exploitation has been reported.

Successful exploitation of this vulnerability could lead to unauthorized information disclosure over a network. The impact is limited to confidentiality, with no integrity or availability effects reported. The attack vector is network-based with low attack complexity and no privileges required, but user interaction is necessary. No known exploits are currently active in the wild.

Microsoft has released an official fix for this vulnerability and manages remediation for Microsoft 365 Copilot as a cloud service. Users and administrators should ensure their Microsoft 365 Copilot service is updated according to Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42827. No additional user action is required beyond applying the official fix.