Introduction
A critical open redirect in Microsoft 365 Copilot allowed an unauthorized attacker to send users from a trusted Microsoft domain to a malicious site. That opened a path to privilege escalation across network boundaries. Copilot has over 15 million paid seats and Microsoft 365 has 450 million commercial seats, so even a cloud-only flaw in this service matters to a lot of enterprise security teams.
Microsoft disclosed CVE-2026-33102 on April 23, 2026, with a CVSS base score of 9.3. Microsoft researchers Bushra Aloraini, Rodrigo Silva, and Henrique Pereira found the vulnerability internally, and Microsoft fixed it server-side before any public disclosure or known exploitation.
Technical Information
The vulnerability is classified as CWE-601: URL Redirection to Untrusted Site, commonly called an open redirect. According to OWASP documentation, an open redirect occurs when an application accepts user-controlled input as a redirect target without proper validation. For Microsoft 365 Copilot, that means the service had an endpoint or parameter that could be manipulated to send users to an attacker-controlled destination.
The CVSS base score of 9.3 (Critical) breaks down as follows:
| Metric | Value |
|---|---|
| Base Score | 9.3 Critical |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | Required |
| Scope | Changed |
| Confidentiality | High |
| Integrity | High |
| Availability | None |
The "Scope: Changed" rating means the flaw in one component (Copilot's redirect handling) affects resources outside that component's own security scope. Together with the high confidentiality and integrity impact, this suggests an attacker could use the open redirect to compromise authentication tokens, session data, or other sensitive artifacts that belong to a different trust boundary.
Why Open Redirects on Trusted Domains Matter
An open redirect on a trusted domain like microsoft.com makes an effective phishing vector, because the link the victim sees starts on a legitimate Microsoft domain. That helps it get past both user suspicion and email security filters. Open redirects also work as building blocks in longer exploit chains. Attackers commonly use them to steal OAuth authorization codes by manipulating the redirect_uri parameter in an OAuth flow, or to bypass server-side request forgery (SSRF) protections that allowlist trusted domains.
Attack Flow
Based on the CVSS vector and CWE classification, a plausible attack would go like this:
- The attacker identifies the vulnerable redirect endpoint in the Microsoft 365 Copilot service.
- The attacker crafts a URL that points to the legitimate Copilot domain but embeds a malicious redirect target as a parameter.
- The attacker delivers this URL to a victim through a phishing email, a chat message, or another social engineering channel.
- The victim clicks the link, trusting the microsoft.com domain.
- The Copilot service processes the request and redirects the victim's browser to the attacker-controlled site.
- At that site, the attacker can harvest credentials, OAuth tokens, or session cookies and use them to escalate privileges.
The "User Interaction: Required" metric confirms that exploitation depends on a victim clicking the crafted link. Still, the low attack complexity and the absence of any privilege requirement mean any external attacker could attempt this without prior access to the target environment.
Patch Information
Microsoft has fully resolved CVE-2026-33102 with a server-side fix applied directly to the Microsoft 365 Copilot cloud service. Microsoft published the advisory on April 23, 2026, and the MSRC page states: "This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take."
Microsoft 365 Copilot is a cloud-hosted service, so this patch is not a traditional downloadable update. Microsoft fixed the underlying CWE-601 flaw entirely on its own backend infrastructure. The CVSS temporal vector includes RL:O (Remediation Level: Official Fix), which means a complete vendor solution is in place. The Security Updates table in the advisory has only one entry, Microsoft 365 Copilot, with its "Customer Action Required" field set to "Not Required".
This follows Microsoft's transparency initiative for cloud service CVEs, under which Microsoft now publishes CVE records even for vulnerabilities it patched silently on the service side, purely to inform the security community. Every Microsoft 365 Copilot tenant was protected the moment Microsoft deployed the fix. Administrators did not need to intervene, install an update, or change any configuration.
The CVE.org record tags the MSRC advisory as both "vendor-advisory" and "patch", so the advisory itself is the official patch notice. No separate KB article, build number, or downloadable binary comes with this fix, which is expected for a service-side fix to a cloud product.
Compensating Controls
The core fix needs no customer action, but organizations should still consider compensating controls:
- Security teams should teach users about phishing that abuses trusted domains, since open redirects work by exploiting domain trust.
- Developers building integrations with Microsoft 365 Copilot should make sure their own applications validate redirect targets and avoid user-controlled absolute URLs in redirect logic.
Affected Systems and Versions
The vulnerability affects Microsoft 365 Copilot as a cloud-hosted service. Because this is a service-side issue rather than a client-side software flaw, Microsoft has not published specific version numbers or build identifiers. The advisory lists a single affected product entry: Microsoft 365 Copilot. Every tenant using the service was potentially affected before Microsoft's server-side fix, and every tenant is now protected without any customer action.
Vendor Security History
Microsoft recently changed its transparency policies for cloud vulnerabilities. The Microsoft Security Response Center now issues CVE records for critical cloud service vulnerabilities even when customers do not need to install a patch, and tags them "exclusively hosted service" to show that no customer action is required. CVE-2026-33102 is exactly the kind of cloud-only issue that would have gone unannounced under the older disclosure practices. The initiative, detailed at aka.ms/MSRC-Cloud-CVEs, is a meaningful step toward giving security teams visibility into vulnerabilities in services they rely on, even when Microsoft resolves those vulnerabilities without customer involvement.
