This vulnerability (CWE-77) in Microsoft 365 Copilot involves improper neutralization of special elements in commands, enabling an authorized attacker to perform command injection and execute arbitrary code remotely. The vulnerability has a CVSS 3.1 score of 7.7, indicating high severity, with network attack vector, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. Microsoft manages remediation for this cloud-hosted service and has issued an official fix as documented in their security update guide.

An authorized attacker can exploit this vulnerability to execute arbitrary code remotely on Microsoft 365 Copilot, potentially leading to high confidentiality impact, limited integrity impact, and limited availability impact. This could allow unauthorized actions within the scope of the compromised service.

Microsoft has released an official fix for this vulnerability in Microsoft 365 Copilot. As this is a cloud service, Microsoft manages the remediation server-side. Users should ensure their service is updated according to Microsoft's guidance available in the vendor advisory.