An unauthorized information disclosure vulnerability in Microsoft 365 Word Copilot permits remote attackers to access sensitive data through improperly neutralized control sequences.

This flaw is classified as an improper neutralization of escape, meta, or control sequences (CWE-150), allowing an unauthenticated attacker to trigger unauthorized information disclosure. The vulnerability relies on user interaction and impacts the confidentiality of the affected software.

Successful exploitation of this vulnerability allows an attacker to access sensitive information that should otherwise be protected, potentially leading to significant data breaches or exposure of internal business documents. With a CVSS score of 7.4, this issue represents a high-severity risk that could compromise organizational confidentiality and lead to regulatory or reputational damage.

Immediate Action: Review the Microsoft Security Update Guide for CVE-2026-21521 and apply all recommended patches or configuration updates as soon as they are released by the vendor.

Proactive Monitoring: Monitor network traffic and access logs for unusual patterns involving Copilot interactions, specifically looking for anomalous sequences that may indicate exploitation attempts.

Compensating Controls: Implement organizational policies to limit the exposure of sensitive documents to AI-enabled features until patches are verified as deployed across the enterprise environment.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the high impact on data confidentiality, organizations using Microsoft 365 Word Copilot must prioritize this vulnerability. It is essential to monitor official Microsoft communication channels for the release of specific patches and ensure that security updates are applied immediately upon availability to mitigate the risk of unauthorized data access.