9.3
Critical
CVE-2026-41106 Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate…
Description
Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft 365 Copilot | Versions not published |
References
- Microsoft 365 Copilot Elevation of Privilege Vulnerability msrc.microsoft.com
Timeline
- Published
- Last modified
Other CVEs of Microsoft 365 Copilot
The 14 CVEs of Microsoft 365 Copilot →
CVE-2026-85887
Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose…
7.7
High
CVE-2026-85885
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized…
9.9
Critical
CVE-2026-50517
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network
9.9
Critical
CVE-2026-47645
Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows an unauthorized…
8.8
High