This vulnerability (CWE-502) in Microsoft 365 Copilot arises from improper deserialization of untrusted data, enabling an attacker with authorized access to execute arbitrary code remotely. The flaw affects the cloud-hosted Microsoft 365 Copilot service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, no user interaction, and complete impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service.

Successful exploitation allows an authorized attacker to execute arbitrary code remotely on Microsoft 365 Copilot, potentially leading to full compromise of confidentiality, integrity, and availability of the service. This could result in unauthorized data access, modification, or service disruption.

Microsoft has released an official fix for this vulnerability and manages remediation for the cloud-hosted Microsoft 365 Copilot service. Administrators and users should ensure their service is updated per Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50517. No additional action is required beyond applying the official fix.