CVE-2026-41106: Microsoft 365 Copilot Elevation of Privilege Vulnerability

Synopsis

An open redirect vulnerability in Microsoft 365 Copilot allows an unauthenticated remote attacker to redirect victims to an attacker-controlled site, enabling privilege escalation. The vulnerability is reachable over the network, requires no authentication, but does require the victim to follow a crafted link. Successful exploitation gives the attacker elevated privileges, with high impact to confidentiality and integrity of data accessible through the Copilot service. No fix version has been published yet; HarborGuard tracks the advisory and will make a patched rebuild available as soon as upstream ships one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target service over the network; the vulnerability is exposed via a network-accessible endpoint.

• AuthenticationNot required

  No account or credentials are needed; the attacker can initiate the attack without any prior authentication.

• Victim interactionRequired

  The victim must follow a crafted URL, making this a social-engineering vector where the attacker tricks a user into clicking a malicious link.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environment-specific factors.

Blast Radius

• Attacker gains elevated privileges within Microsoft 365 Copilot, enabling access beyond the victim's own permission boundary.
• High confidentiality impact: the attacker can read data the victim's account has access to, including files, conversations, and AI-generated outputs surfaced by Copilot.
• High integrity impact: the attacker can modify or submit actions on behalf of the victim within the Copilot service, including altering documents or triggering Copilot commands.
• Availability is not directly impacted by this vulnerability; the service continues to run while the attacker operates with elevated access.