This vulnerability (CWE-77) involves improper neutralization of special elements used in commands within Microsoft Copilot for Outlook. An authorized attacker with network access can exploit this flaw to perform command injection, leading to tampering. Microsoft has published an official fix to address this issue. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges at the level of an authorized user, user interaction required, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact.

The vulnerability allows an authorized attacker to execute command injection attacks remotely, potentially leading to unauthorized tampering of data or system behavior. Confidentiality impact is high, meaning sensitive information could be exposed. Integrity impact is low, and availability is not affected. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the patch provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55145 to remediate this vulnerability.