Server-Side Request Forgery Vulnerability in Microsoft 365 Copilot
CVE-2026-26137

8.9HIGH

Key Information:

Vendor

Microsoft
Status
Microsoft 365 Copilot's Business Chat
Vendor
CVE Published:
19 March 2026

What is CVE-2026-26137?

A server-side request forgery (SSRF) vulnerability in Microsoft 365 Copilot's Business Chat enables an authorized attacker to leverage the system to elevate privileges within the network. This flaw could allow unauthorized access to internal resources, which could lead to further exploitation and data breaches. It is crucial for organizations using this product to apply available patches promptly and implement robust security protocols to mitigate the risks associated with such vulnerabilities.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Microsoft 365 Copilot's Business Chat -

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
8.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.