The vulnerability is an open redirect in Microsoft 365 Copilot that permits an unauthorized attacker to gain elevated privileges on a network. By manipulating the redirect URL, the attacker can cause the application or user to navigate to a malicious host, enabling unauthorized access or influence over resources. This flaw is classified as CWE‑601 and allows bypass of intended navigation controls.

Microsoft 365 Copilot is the affected product. The vendor is Microsoft. Specific version information is not supplied, meaning any installation of Microsoft 365 Copilot that has not received an update may be vulnerable.

The CVSS score of 9.3 indicates a critical severity, while the EPSS score of less than 1% suggests a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted URL sent through email or a document that exploits the open redirect behavior to elevate privileges. If exploited, an attacker could bypass authentication constraints and gain higher‑level access on the network.