Introduction
An unauthenticated information disclosure vulnerability in Microsoft 365 Copilot Business Chat allowed remote attackers to leak sensitive organizational data without any user interaction or prior authentication. Many enterprises have woven Copilot into daily workflows, where it aggregates emails, chats, documents, and other Microsoft Graph-connected content. For them, this flaw exposes far more than a typical web application bug would.
Microsoft disclosed CVE-2026-26129 on May 7, 2026. It assigned a CVSS 3.1 base score of 7.5 (High) and at the same time elevated the maximum severity to Critical. The vendor has already deployed a server-side fix, and no customer action is required. Still, this is the third information disclosure flaw in Copilot disclosed in 2026, and it raises questions about how mature input sanitization is in large language model integrations.
Technical Information
Root Cause: CWE-138 and Prompt Boundary Failures
The vulnerability is classified under CWE-138: Improper Neutralization of Special Elements. In an AI-powered assistant like Copilot Business Chat, this weakness appears when delimiters, control sequences, or prompt boundaries are not properly sanitized. If special elements embedded in input are mishandled, the underlying language model can interpret text that should be passive data as instructions. The system can then retrieve or expose information from the user's work context. For Copilot, that context includes emails, Teams messages, SharePoint documents, and other Microsoft Graph-connected resources.
CVSS Vector Breakdown
Microsoft published the following CVSS 3.1 vector string:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Each metric, and what it means for the attack surface:
| Metric | Value | Implication |
|---|---|---|
| Attack Vector | Network | Remotely exploitable |
| Attack Complexity | Low | No special conditions required |
| Privileges Required | None | No authentication needed |
| User Interaction | None | No victim action required |
| Scope | Unchanged | Impact confined to the vulnerable component |
| Confidentiality | High | Significant data exposure possible |
| Integrity | None | No data modification |
| Availability | None | No denial of service |
| Exploit Code Maturity | Unproven | No public exploit code exists |
| Remediation Level | Official Fix | Vendor has deployed a patch |
No authentication, no user interaction, low attack complexity, and high confidentiality impact: that combination is what sets this vulnerability apart. Microsoft's escalation to Critical, despite the 7.5 base score, reflects the fact that Copilot processes aggregated enterprise data. A successful exploit could expose a broad cross section of organizational content rather than a single record.
What We Do Not Know
Microsoft has not published specific payload examples, the exact parsing contexts affected, or the specific classes of information that could be leaked. The National Vulnerability Database has not yet provided an enriched assessment. Without these details, we cannot describe a precise exploitation flow.
The vulnerability does fit a well-understood pattern. When an AI system fails to properly distinguish data from instructions at prompt boundaries, its retrieval capabilities can be turned against the organization it serves.
Affected Systems and Versions
The vulnerability affects Microsoft 365 Copilot Business Chat, a cloud-hosted service. Microsoft has not published specific version numbers or build identifiers, because it manages the service centrally and updates it on the server side. All organizations using Copilot Business Chat before the vendor-applied fix were potentially affected.
Vendor Security History
CVE-2026-26129 is the third information disclosure vulnerability disclosed in Microsoft 365 Copilot in 2026 alone:
| CVE ID | Publication Date | Weakness Type |
|---|---|---|
| CVE-2026-24307 | January 23, 2026 | Improper input validation causing information disclosure |
| CVE-2026-26133 | March 20, 2026 | AI command injection flaw |
| CVE-2026-26129 | May 7, 2026 | Improper neutralization of special elements |
This pattern suggests that securing prompt boundaries and neutralizing malicious inputs is still a systemic problem for large language model integrations, even for a vendor with Microsoft's security resources. The Microsoft Security Response Center has responded quickly and consistently, deploying server-side fixes before public disclosure in each case. Even so, security teams evaluating the risk posture of AI tools in their environments should pay attention to how often these disclosures are arriving.
References
- Microsoft Security Update Guide: CVE-2026-26129
- NVD Entry: CVE-2026-26129
- CVE Record: CVE-2026-26129
- MITRE CVE API: CVE-2026-26129
- WindowsForum Analysis: Critical Info Leak Fixed in Microsoft 365 Copilot Business Chat
- SentinelOne: CVE-2026-24307 M365 Copilot Information Disclosure Flaw
- SentinelOne: CVE-2026-26133 M365 Copilot Information Disclosure Flaw
- Microsoft Blog: Microsoft 365 Copilot, Human Agency, and the Opportunity for Every Organization
