This vulnerability (CWE-77) in Microsoft Copilot involves improper neutralization of special elements in commands, leading to command injection. Exploitation can result in unauthorized information disclosure over a network. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, and scope changed. Confidentiality impact is high, with no integrity or availability impact. Microsoft has published an official fix for this vulnerability.

An attacker who successfully exploits this vulnerability can disclose sensitive information over a network without requiring privileges but with user interaction. The integrity and availability of the system are not affected. The vulnerability's medium severity reflects the potential for information disclosure but limited impact on system control or availability.

An official fix is available from Microsoft. Users and administrators should apply the patch as provided in the Microsoft security update guide for CVE-2026-55946. No additional mitigation steps are indicated by the vendor advisory.