CVE-2026-41106: Open Redirect in Microsoft 365 Copilot

CVE-2026-41106 is an open redirect flaw in Microsoft 365 Copilot, scored CVSS 9.3. The record says an unauthorized attacker can elevate privileges over a network, with user interaction. The MSRC entry is the source for remediation, so read it for any customer action.

What's affected

The NVD record names Microsoft 365 Copilot and lists no versions. The vector requires user interaction and has changed scope. The MSRC Security Update Guide page is script driven and returned no text to my fetch, so I cannot say whether Microsoft fixed this on the service side or whether you must do anything.

Microsoft often resolves cloud service issues itself and states that no customer action is required. Confirm that on the entry for this CVE.

How to check if you're exposed

1. Open the MSRC entry for CVE-2026-41106 and read the remediation and FAQ sections.
2. Confirm whether your tenant uses Microsoft 365 Copilot.
3. If the entry names a customer action, follow it.
4. Remind users to check where a sign in or a shared link takes them before entering credentials.

What to do now

1. Read the MSRC entry and note any customer action.
2. Check tenant settings the entry points to.
3. Review conditional access and consent settings for your tenant as a general hygiene step.
4. Tell users to report unexpected redirects or sign in prompts.

Why it matters

The weakness is CWE-601, URL redirection to an untrusted site, commonly called open redirect. A trusted address sends the visitor onward to a destination controlled by someone else. The trusted look of the starting address is what makes the attack work.

The high score comes from the changed scope and the effects on confidentiality and integrity. The record does not flag exploitation in the wild, and I found no text saying so.

Quick check

Sources

• Microsoft MSRC entry for CVE-2026-41106 (script driven page, not readable by my fetch)
• Gold page for this CVE

Last reviewed: 19 October 2026.