Improper neutralization of special elements used in a command in M365 Copilot allows an unauthorized attacker to disclose information over a network. The flaw is a command injection—improper neutralization of special elements during command execution. If exploited, confidential information or system data could be exposed across the network, potentially allowing disclosure of business communications or internal state.

Microsoft 365 Copilot Business Chat. No specific version range is provided in the advisory, but all deployments of the component are vulnerable until a vendor‑supplied fix is applied.

The CVSS score of 7.5 indicates high severity. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread active exploitation is reported yet. The likely attack vector is remote via the network: an unauthorized user can send malicious input to the chat interface and receive disallowed data in return. Because the flaw allows data disclosure without requiring privileged access or additional local exploits, the risk remains significant for any system that processes untrusted chat content.