An information disclosure vulnerability in Microsoft M365 Copilot allows unauthenticated attackers to access sensitive data over the network via command injection.

This is an improper neutralization of special elements in a command, categorized as CWE-74. The vulnerability can be exploited remotely by an unauthenticated attacker over the network without requiring any user interaction.

A successful exploit permits unauthorized external actors to view sensitive organizational data processed or stored within Microsoft 365 Copilot Business Chat. Given the CVSS score of 7.5, this high severity flaw threatens data confidentiality and can lead to severe regulatory and compliance violations if proprietary or personally identifiable information is exposed.

Immediate Action: Apply the official security updates provided by Microsoft through the Microsoft Security Response Center as soon as possible.

Proactive Monitoring: Monitor network and application logs for unusual query patterns or unexpected data retrieval requests targeting Copilot endpoints.

Compensating Controls: Implement strict network perimeter controls and utilize Web Application Filters where applicable to inspect traffic destined for Copilot integrations.

Public Exploit Available: No

Organizations utilizing Microsoft 365 Copilot must treat this high severity vulnerability with urgency. Administrators should immediately check the Microsoft advisory portal for patch availability and apply the necessary updates to prevent potential unauthorized information disclosure.