This vulnerability (CVE-2026-54130) in Microsoft 365 Copilot is classified as CWE-306, indicating missing authentication for a critical function. This flaw enables an attacker without any privileges or user interaction to access sensitive information remotely. The CVSS 3.1 base score of 9.8 reflects network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The product is a cloud service, and Microsoft manages remediation by deploying an official fix server-side.

An attacker can remotely access and disclose sensitive information from Microsoft 365 Copilot without authentication, potentially compromising confidentiality, integrity, and availability of the service and its data. This poses a critical risk to organizations relying on this cloud service for productivity and data management.

Microsoft has released an official fix for this vulnerability and manages remediation for the cloud-hosted Microsoft 365 Copilot service. Administrators and users should ensure that their Microsoft 365 Copilot service is updated according to Microsoft's guidance in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54130. No additional mitigation actions are required beyond applying the official fix.