CVE-2026-54130: M365 Copilot Information Disclosure Vulnerability

Synopsis

Missing authentication for a critical function in Microsoft 365 Copilot allows an unauthenticated remote attacker to reach and exploit the vulnerable endpoint over the network with no privileges required. Successful exploitation gives the attacker full read, write, and denial-of-service capability against the affected service, enabling data disclosure, content tampering, and service disruption. HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment Microsoft publishes an upstream fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the vulnerable M365 Copilot endpoint over the network; no physical or local access is needed.

• AuthenticationNot required

  No credentials or session token of any kind are required; the vulnerable function is reachable by any unauthenticated caller.

• Victim interactionNot required

  No user action is needed; the attacker can trigger the vulnerability directly without involving any other party.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental setup.

Blast Radius

• A successful attacker reads sensitive data stored or processed by M365 Copilot, including documents, prompts, and any cached user content the service can access.
• The attacker writes or modifies content within the service, enabling injection of malicious responses, alteration of stored data, or tampering with Copilot outputs.
• The attacker disrupts service availability, causing M365 Copilot to become unresponsive to legitimate users.
• Because all three CVSS impact dimensions score High, the attacker achieves simultaneous confidentiality breach, integrity loss, and availability disruption in a single exploitation chain.