CVE-2026-47645 is a CWE-601 open redirect vulnerability affecting Microsoft 365 Copilot's Business Chat feature. The vulnerability enables an attacker to redirect users to untrusted external sites, potentially facilitating privilege escalation. It has a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. Microsoft has released an official fix for this cloud-hosted service. There are no known exploits in the wild at this time.

Successful exploitation allows attackers to redirect users to malicious external sites, which could lead to privilege escalation and compromise of user data or system integrity. The high CVSS score reflects significant potential impact on confidentiality, integrity, and availability. However, no active exploitation has been reported.

Microsoft has issued an official fix for this vulnerability in their cloud-hosted Microsoft 365 Copilot service. The vendor manages remediation server-side, so customers should ensure their service is updated per Microsoft's guidance. No additional user action is required beyond applying the official fix.