M365 Copilot Business Chat Information Disclosure (CVE-2026-26164): Brief Summary of an Injection Flaw in Microsoft's AI Assistant

Introduction

An injection flaw in Microsoft 365 Copilot Business Chat could have let an unauthenticated attacker silently extract sensitive information over the network, with no user interaction required. Copilot now runs on 20 million paid seats in the M365 commercial base. At that scale, security teams should track even a fully mitigated cloud vulnerability like this one in a structured way and have a clear operational response ready.

Technical information

The root cause of CVE-2026-26164 is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component. In Microsoft 365 Copilot Business Chat, specially crafted input could shape the output that a downstream component consumed in ways that were not intended, and that led to information disclosure.

CVSS breakdown

The CVSS 3.1 base score is 7.5, a high-severity rating built from these metrics:

A network attack vector, with no privileges and no user interaction required, makes for a broad attack surface. Before the mitigation, any network-accessible endpoint serving Copilot Business Chat functionality was potentially reachable.

Attack flow

Judging from the vulnerability characteristics, exploitation would proceed in four steps:

1. An unauthorized attacker, working remotely over the network, crafts input that contains special elements and sends it to the Copilot Business Chat service.
2. The Copilot Business Chat service fails to properly neutralize these special elements in its output.
3. A downstream component processes the tainted output, and the injected elements alter its behavior.
4. The downstream component discloses information back to the attacker.

Because the attack needed no authentication and no user interaction, the barrier to exploitation was low. The impact was high for confidentiality and none for integrity or availability, which marks this as a pure data exfiltration vector. The attacker could read data but could not modify it or disrupt service.

Scope of affected components

The affected product is Microsoft 365 Copilot Business Chat. The vulnerability record does not explicitly call out any other Microsoft 365 services. That narrow scope lets security teams direct their communications and risk tracking to Business Chat owners and Copilot program leads instead of the broader user base.

Affected systems and versions

The vulnerability affects Microsoft 365 Copilot Business Chat. Microsoft has not published version numbers or version ranges, because this is a cloud service vulnerability that Microsoft mitigated on the server side. Every instance of the service was affected until Microsoft applied the mitigation, and every instance is now remediated. No other Microsoft 365 services are explicitly identified as affected.

Vendor security history

CVE-2026-26164 is not an isolated finding in the M365 Copilot product line. CVE-2026-24299 describes a separate command injection vulnerability in M365 Copilot, and together the two show injection weaknesses recurring in AI-integrated services. The pattern suggests that large language model integrations open a systemic category of risk, particularly around prompt and content injection, and that Microsoft and other vendors will keep addressing it as these products mature.

Microsoft publishes cloud vulnerability advisories even when customers have nothing to do, a level of transparency that is relatively uncommon among cloud service providers. Organizations should expect more advisories of this type and tune their internal processes to handle them.

Copilot adoption context

The size of the Copilot deployment puts the potential impact in perspective:

References

• CVE-2026-26164: Microsoft Security Update Guide
• CVE Record: CVE-2026-26164 (CVE.org)
• NVD Entry for CVE-2026-26164
• Microsoft Claims 15 Million Paid M365 Copilot Seats (Directions on Microsoft)
• Microsoft 365 Copilot Hits 20 Million Paid Seats (No Jitter)
• CVE-2026-24299: M365 Copilot Command Injection (SentinelOne)