Horizon Alert
Summary of the vulnerability and why it matters
An open redirect vulnerability in M365 Copilot could let an attacker redirect users to an untrusted site, potentially leading to unauthorized privilege escalation. This issue deserves attention because it could impact user accounts and data security across the network.
- Attacker redirects users to malicious sites.
- Potential for privilege escalation.
- Affects M365 Copilot users.
Attack Path
How an attacker could exploit the issue
An attacker can exploit this open redirect vulnerability in M365 Copilot to trick users into clicking malicious links, potentially leading to credential theft or further compromise. This could be used in phishing campaigns targeting M365 users, directing them to fake login pages or malicious sites.
- No authentication required.
- Triggered by user interaction with a crafted URL.
- Exploitable over the network.
Live Threat
Current exploitation, exposure, and threat context
This CVE describes an open redirect vulnerability in M365 Copilot, which could allow an attacker to trick users into visiting a malicious site. While privilege escalation is mentioned, the primary threat from this specific vulnerability appears to be phishing and credential theft by redirecting users through a compromised link. The current threat landscape shows a significant interest in vulnerabilities impacting widely used productivity suites for broad impact.
- No known exploit publicly available.
- Not listed on KEV.
- Published in April 2026.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize assessing M365 Copilot for any signs of exploitation or suspicious redirection activity. If active exploitation is detected or the risk is high, isolate affected services or take them offline immediately.
- Block or filter suspicious URLs.
- Monitor for anomalous user activity.
- Enable enhanced logging for M365 Copilot.
