This vulnerability (CVE-2026-42895) in Microsoft 365 Copilot involves improper neutralization of special elements in commands, classified as CWE-77 (Command Injection). It enables an unauthorized attacker to tamper with the system remotely. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. Microsoft has provided an official fix, and as a cloud service, remediation is managed by Microsoft.

An attacker can exploit this vulnerability to perform unauthorized tampering actions over the network, potentially altering data or system behavior within Microsoft 365 Copilot. There is no impact on confidentiality or availability, but integrity is rated high. No known exploits are currently active in the wild.

Microsoft has released an official fix for this vulnerability. As Microsoft 365 Copilot is a cloud-hosted service, Microsoft manages the remediation process server-side. Users should ensure their service instances are updated per Microsoft's guidance. No additional user action is required beyond applying the official fix.