CVE-2026-33102

The vulnerability consists in the possibility of redirecting a user to an untrusted external website through a crafted URL (CWE-601 — URL Redirection to Untrusted Site). An attacker can trick the victim into clicking a malicious link that appears to point to a trusted Microsoft 365 Copilot domain, but actually redirects to a page controlled by the attacker. User interaction is required (UI:R), however the attacker does not need any prior privileges or authentication. This mechanism can be exploited to steal credentials or carry out further stages of an attack with elevated privileges.

An attacker can cause privilege escalation in the network context and expose the victim to high risk of confidentiality and integrity breach, potentially gaining access to resources beyond the original scope of the application.

Apply patches available from the vendor according to references: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33102. Additionally, it is recommended to educate users on verifying URLs before clicking links and implementing proxy filtering with outbound traffic inspection.

Microsoft 365 Copilot — versions indicated in vendor references