The vulnerability allows an unauthenticated attacker to view sensitive information in Copilot Studio via a network attack vector. This exposure can compromise the confidentiality of data, potentially enabling the attacker to retrieve proprietary or personal information that should be protected. The weakness is identified as CWE‑77, indicating a command injection or similar flaw that can be abused to access protected data.

The affected product is Microsoft Copilot Studio. No specific version details are provided, implying that all current releases may be vulnerable until a patch is applied.

The CVSS score of 7.5 places this issue in the High range, yet the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, which may reflect its limited exploitation history. The likely attack vector is a network-based request to Copilot Studio that an unauthenticated user can trigger, utilizing the underlying command injection weakness to read restricted data.