This vulnerability, identified as CVE-2026-55145 and categorized under CWE-77 (Improper Neutralization of Special Elements used in a Command), affects Microsoft Copilot's Outlook component. It enables an attacker with authorized access to execute command injection attacks by exploiting insufficient sanitization of command inputs. The vulnerability can be exploited remotely over a network and results in high confidentiality impact, limited integrity impact, and no availability impact. Microsoft has released an official fix to address this issue.

An authorized attacker can exploit this vulnerability to perform command injection attacks remotely, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and limited tampering (low integrity impact). There is no impact on system availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the provided security update as soon as possible to remediate this vulnerability. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55145 for detailed patching instructions.