The vulnerability arises from improper neutralization of special elements used in a command, leading to command injection in Microsoft 365 Copilot. An attacker with authorized access can invoke arbitrary system commands over a network, potentially compromising confidentiality, integrity, and availability of the affected environment.

Microsoft 365 Copilot is affected. No specific version information is disclosed, so all current releases should be checked for the presence of the fix.

The CVSS score is 7.7, representing a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. An attacker requires authorized, authenticated access to a Copilot session, and the exploitation path involves providing specially crafted input that the system fails to sanitize, enabling remote code execution.