CVE-2026-54130

A missing authentication check could expose information in Microsoft 365 Copilot

Microsoft · Microsoft 365 Copilot cloud service

First documented disclosure · Review checkpoint

Summary

Microsoft reports that an unauthenticated network caller could obtain information from a critical service function.

Severity and exploitation evidence

Critical · 9.8/10 · CVSS 3.1. Severity source.

Exploitation not established: Microsoft listed exploitation as No in its disclosure. No victim count was published.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

A service function lacked the required authentication check. Microsoft did not identify the affected operation in its public bulletin.

Conditions required

Network access to the affected service behavior. Microsoft’s scoring vector requires neither a valid account nor user interaction.

Potential impact

Information disclosure. The exact data classes, users and exposure duration were not published.

Affected versions and configurations

Microsoft 365 Copilot service. No client version range was specified.

Fix and mitigation status

Microsoft reports full service-side mitigation. It specifies no customer-installed update.

Practical next steps

No customer patch is required according to Microsoft. If auditing historical exposure, use the provider’s disclosure and support channels.

Operating lesson

Examine authentication on individual service functions as well as the application’s main sign-in.

Evidence and limits

The June 18 bulletin describes information disclosure. Its 9.8 CVSS 3.1 base score is a severity assessment and does not measure observed losses.

Sources