AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

MicrosoftCVE-2026-41106

Microsoft 365 Copilot: open redirect

Microsoft

CVE-2026-41106 · Published Jul 2, 2026 · updated Jul 7, 2026

Critical9.3
No fix yet
Microsoft advisory

Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.

Affected versions

PackageAffectedFixed in
Microsoft 365 Copilot
Product
all versionsNo fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-601

More Microsoft advisories

All Microsoft
High 8.8Jul 3Microsoft Edge (Chromium-based): integer overflowCVE-2026-57974fixed in 150.0.4078.48Critical 9.9Jul 2Microsoft Azure Open AI: server-side request forgeryCVE-2026-45499no fix yetHigh 8.8Jul 2Microsoft Exchange Online: improper authorizationCVE-2026-54998no fix yetCritical 9.9Jul 2Microsoft Entra Provisioning Service: server-side request forgeryCVE-2026-57100no fix yetMedium 4.8Jul 2Microsoft Azure Synapse: improper access controlCVE-2026-26145no fix yetHigh 8.3Jul 1Microsoft Edge (Chromium-based): use after freeCVE-2026-50521fixed in 149.0.4022.68