This vulnerability (CVE-2026-45497) in Microsoft 365 Copilot is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command, i.e., command injection). It allows an attacker with limited privileges and no user interaction to execute code remotely by exploiting improper input handling in command processing. The CVSS 3.1 base score is 7.7, reflecting network attack vector, high impact on confidentiality, low impact on integrity, and low impact on availability. The vulnerability is in a cloud service, and Microsoft has released an official fix to address it.

Successful exploitation could allow an authorized attacker to execute arbitrary code remotely on the Microsoft 365 Copilot service, potentially leading to a complete compromise of confidentiality, partial integrity loss, and partial availability impact. However, exploitation requires some level of privilege and no user interaction is needed. There are currently no known exploits in the wild.

Microsoft has released an official fix for this vulnerability and manages remediation for the cloud-hosted Microsoft 365 Copilot service. Customers should ensure their service is updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45497. No additional customer action is required beyond applying the official fix or verifying the service is up to date.