The vulnerability is a missing authentication flaw that permits an unauthorized attacker to call a critical function in Microsoft 365 Copilot and retrieve sensitive data over the network. The analysis indicates that the exposure is limited to information disclosure; no evidence of command execution is reported, even though the flaw is classified as CWE‑77.

Microsoft 365 Copilot is the affected product. Because no specific version ranges are provided, all instances of this product are potentially vulnerable until Microsoft releases an official fix.

The CVSS score of 6.5 indicates moderate severity. An EPSS score of 8% shows a moderate likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalogue, suggesting no publicly known exploits have been documented. The likely attack vector is network‑based, inferred from the description that an unauthenticated attacker can invoke a critical function over the network. The attacker does not need privileged access, but must be able to reach the Copilot interface to exploit the missing authentication.