The vulnerability in Microsoft 365 Copilot’s Business Chat arises from an improper neutralization of special elements. When an attacker can influence the Chat input to include such elements, the system incorrectly processes them, allowing the attacker to read sensitive data that is normally protected. The primary effect is the accidental disclosure of private information to an unauthorized party.

All instances of Microsoft 365 Copilot’s Business Chat are potentially impacted, as no specific version constraints are listed by the vendor. Users who enable or regularly use the Business Chat feature are at risk.

With a CVSS score of 7.5 the flaw is classified as high severity for information disclosure. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, indicating limited public exploitation evidence. The likely attack vector requires the attacker to inject or manipulate Chat content, a capability that is limited to accounts with access to the Business Chat interface or to public-facing chat surfaces that accept user input.