This vulnerability (CWE-77) in Microsoft 365 Copilot involves improper neutralization of special elements in commands, enabling an authorized attacker to perform command injection and execute code remotely. The CVSS 3.1 base score is 7.7, reflecting network attack vector, high complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. Microsoft has released an official fix and, as this is a cloud service, remediation is managed server-side by Microsoft.

An authorized attacker can exploit this vulnerability to execute arbitrary code remotely on the Microsoft 365 Copilot service. This can lead to high confidentiality impact, partial integrity loss, and partial availability disruption. There are no known exploits in the wild at this time.

An official fix is available and has been applied by Microsoft to the cloud-hosted Microsoft 365 Copilot service. Customers do not need to take additional action as Microsoft manages the remediation. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45497 for the latest status.