Server-Side Request Forgery Vulnerability in Microsoft 365 Copilot
CVE-2026-26137

9.9CRITICAL

Key Information:

Vendor

Microsoft
Status
Microsoft Exchange Online
Vendor
CVE Published:
19 March 2026

What is CVE-2026-26137?

A server-side request forgery (SSRF) vulnerability in Microsoft 365 Copilot's Business Chat enables an authorized attacker to leverage the system to elevate privileges within the network. This flaw could allow unauthorized access to internal resources, which could lead to further exploitation and data breaches. It is crucial for organizations using this product to apply available patches promptly and implement robust security protocols to mitigate the risks associated with such vulnerabilities.

Affected Version(s)

Microsoft Exchange Online -

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.