CVE-2026-59118 is an improper authorization vulnerability (CWE-285) in Microsoft Copilot Cowork. It enables an attacker without prior privileges to elevate their access rights remotely over a network. The vulnerability affects the authorization mechanism, allowing privilege escalation. Microsoft has published an official fix to remediate this issue. No known exploits are reported in the wild at this time.

Successful exploitation of this vulnerability can lead to unauthorized privilege escalation, compromising confidentiality and integrity of the affected system. The attacker can gain elevated access rights remotely, which may allow them to perform actions normally restricted to higher-privileged users. Availability is not impacted according to the CVSS vector.

An official fix is available from Microsoft. Users and administrators should apply the provided patch promptly to remediate the vulnerability. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59118 for detailed update instructions.