Microsoft 365 Copilot’s Business Chat contains an open‑redirect flaw where a user can be directed to an untrusted URL. When this redirect occurs on the Business Chat interface, an attacker who is not authorized can gain elevated privileges over the network. The weakness is a classic ‘open redirect’ (CWE‑601) that permits an unauthorized party to change the target of a link while still appearing to originate from a trusted application.

The vulnerability affects Microsoft 365 Copilot, specifically the Business Chat component. No explicit version information is provided in the advisory, so all current releases of the Business Chat feature are potentially impacted.

The CVSS score of 8.8 indicates a high severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote via the web interface of Business Chat, requiring the attacker to persuade a user to click the malicious link or craft the redirect themselves. Given the high CVSS, this flaw can be used to elevate an attacker’s privileges on the network if exploited successfully.