Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Microsoft
  • 365 Copilot

No data.

No data.

References
Link Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41106 cve-icon
History

Mon, 06 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 02 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Description Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.
Title Microsoft 365 Copilot Elevation of Privilege Vulnerability
First Time appeared Microsoft
Microsoft 365 Copilot
Weaknesses CWE-601
CPEs cpe:2.3:a:microsoft:365_copilot:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft 365 Copilot
References
Metrics cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C'}
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2026-07-02T22:18:57.629Z

Updated: 2026-07-07T03:56:02.755Z

Reserved: 2026-04-16T19:12:36.196Z

Link: CVE-2026-41106

cve-icon Vulnrichment

Updated: 2026-07-06T12:15:00.856Z

cve-icon NVD

No data.

cve-icon Redhat

No data.