The vulnerability arises from inadequate validation of a specific type of input in Microsoft 365 Copilot, enabling an unprivileged attacker to trigger the transmission of confidential data over a network. This flaw results in a loss of confidentiality, allowing attackers to read information that should remain private. No compromise of integrity or availability is indicated by the current description.

Microsoft 365 Copilot, all supported versions of the service are potentially impacted.

The CVSS score of 9.3 indicates a high severity. However, the EPSS score of less than 1% suggests that exploitation is currently unlikely to occur. The flaw is not listed in the CISA KEV catalog. Attackers would need to send specially crafted input to the Copilot interface or API, which can be performed without prior authentication. While the severity remains high, the low probability of exploitation reduces the immediate threat, but organizations should treat it as a critical risk until a patch is applied.