M365 Copilot Critical Open Redirect Allows Privilege Escalation

The National Vulnerability Database has disclosed CVE-2026-33102, a critical open redirect vulnerability in M365 Copilot. This flaw, rated with a CVSS score of 9.3, allows an unauthorized attacker to elevate privileges over a network. The root cause is identified as CWE-601, a classic URL redirection to an untrusted site.

This isn’t just about phishing; an attacker can craft malicious links that appear legitimate, leveraging the trusted M365 domain to redirect users to attacker-controlled sites. From there, it’s a straight shot to credential harvesting, session hijacking, or delivering drive-by downloads. The ‘elevation of privilege’ aspect means this isn’t merely a client-side annoyance; it could lead to broader network compromise if exploited successfully.

While specific affected products beyond ‘M365 Copilot’ are not detailed by the National Vulnerability Database, organizations deploying or planning to deploy Copilot should prioritize understanding the implications. This type of vulnerability is often leveraged as a stepping stone in more complex attack chains, making it a critical concern for defenders.