CVE-2026-78501 is a command injection vulnerability (CWE-77) in Microsoft 365 Copilot's Business Chat. The issue arises from improper neutralization of special elements used in commands, which can be exploited by an unauthorized attacker to disclose sensitive information over a network. The vulnerability has a CVSS 3.1 base score of 7.4, indicating high severity with network attack vector, low attack complexity, no privileges required, but requiring user interaction. The scope is changed, and the impact is high confidentiality impact without integrity or availability impact. Microsoft manages remediation for this cloud service and has released an official fix as per their advisory.

An unauthorized attacker can exploit this vulnerability to disclose sensitive information over a network. The confidentiality impact is high, but there is no impact on integrity or availability. The vulnerability can be exploited remotely without privileges but requires user interaction.

Microsoft has released an official fix for this vulnerability. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should follow the guidance in the Microsoft security advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78501 to ensure the fix is applied or the service is updated accordingly.