CVE-2026-41106

42th percentile - higher than 42% of all known CVEs

An open redirect vulnerability in M365 Copilot allows an unauthorized attacker to redirect users to a malicious site, potentially leading to privilege escalation over a network.

An attacker could exploit this redirect to steal credentials or conduct a phishing attack, posing a risk to organizational security.

Apply the security update provided by Microsoft for M365 Copilot immediately and consider implementing URL validation mechanisms.