CVE-2026-47645Critical
Microsoft 365 Copilot's Business Chat Elevation of Privilege Vulnerability
Assessment
Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a network.
- Severity
- Critical
- CVSS base score
- 8.8CVSS:3.1/
AV:N/ AC:L/ PR:N/ UI:R/ S:U/ C:H/ I:H/ A:H/ E:U/ RL:O/ RC:C - Impact
- Elevation of Privilege
- EPSS, next 30 days
- 0.8%Higher than 53.4% of scored CVEs · FIRST model run 29 Sep 2026 · about EPSS
- Public exploit code
- No Nuclei template lists it
- Exploitability
- Not assessed
- Publicly disclosed
- No
- Customer action
- Not required (service-side fix)
- Component
- Microsoft 365 Copilot's Business Chat
- Weakness
- CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
- Issued by
- Microsoft
- Published
- 18 Jun 2026 · June 2026
- Last revised
- 18 Jun 2026
Updates that fix it
0 KBsNo KB listed
MSRC lists no downloadable update, which usually means a service-side fix or a release-notes update. Check the MSRC advisory.