This vulnerability (CVE-2026-54130) involves missing authentication for a critical function in Microsoft 365 Copilot, enabling unauthorized network-based information disclosure. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges or user interaction, with high impact on confidentiality, integrity, and availability. The affected product is a cloud service, and Microsoft has released an official fix to address the issue.

An attacker can remotely exploit the missing authentication to disclose sensitive information, potentially compromising confidentiality, integrity, and availability of data within Microsoft 365 Copilot. The vulnerability is critical due to the ease of exploitation (no privileges or user interaction required) and the high impact on core security properties.

Microsoft manages remediation for this cloud-hosted service and has released an official fix. Users should ensure their Microsoft 365 Copilot service is updated according to Microsoft's guidance available at the official advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54130. No additional user action is required beyond applying the official fix.