Improper neutralization of special elements used in a command

CVE-2026-24301, dubbed CoSnitch by Varonis Threat Labs, is a prompt-injection flaw in Microsoft Copilot Personal — the *consumer* product at copilot.microsoft.com. An attacker crafts a link using the undocumented autorun=1 URL parameter paired with the ?q= query parameter to auto-execute injected prompts inside a victim's authenticated session. From there, the injected prompt queries connected OAuth applications (Gmail, Google Drive, Outlook.com, OneDrive Personal) and exfiltrates data — email bodies, calendar entries, file metadata, chat history — via outbound HTTPS fetches to an attacker-controlled webhook. The attack requires one click from the victim and no plugins. Affected product: Microsoft Copilot Personal (web), all versions prior to the August 18, 2026 server-side fix.

Microsoft's CVSS 8.8 HIGH is defensible *from a consumer-risk perspective* — the chain is low-complexity, requires no privileges, and yields high-confidentiality/high-integrity impact against a personal user's connected apps. However, Microsoft itself states enterprise customers using Microsoft 365 Copilot are not affected. The fix is server-side; no client patch ships, no MSI rolls out, no endpoint touches are needed. For an enterprise security team running a 10,000-host fleet, this CVE has zero blast radius. The vendor severity is accurate for its intended audience (consumers) but wildly misleading when it appears in an enterprise vulnerability dashboard.

Why this verdict

• Zero enterprise attack surface: Microsoft explicitly states M365 Copilot (enterprise) is not affected. The vulnerable component — Copilot Personal's web frontend with autorun=1 — does not exist in the enterprise product. This is not a 'friction reduction' — the attack path simply does not begin.
• Server-side remediation already complete: The fix was applied by Microsoft on August 18, 2026 within their cloud infrastructure. No MSI, no KB, no WSUS deployment, no SCCM package. The vulnerability no longer exists for anyone, consumer or enterprise.
• Role multiplier: Not applicable. Copilot Personal is a consumer product. It does not run on domain controllers, hypervisors, CI/CD servers, backup infrastructure, or any managed enterprise host. The high-value-role catalog is entirely irrelevant — this component occupies 0% of enterprise deployments by definition. There is no blast radius floor to enforce.
• No endpoint telemetry or footprint: The entire attack chain (prompt injection → data harvest → exfiltration) executes within Microsoft's cloud. Enterprise EDR, SIEM, and network monitoring have no visibility into and no interaction with the vulnerable component.

Why not higher?

This cannot be anything other than IGNORE for enterprise defenders. The affected product is not deployed on managed hosts, the patch is already applied server-side, and no customer action exists to take. Even if one argued that employees might use Copilot Personal on corporate devices, the fix is already live — there is no residual risk to manage.

Why not lower?

IGNORE is already the lowest severity. No further downgrade is possible.

1. Confirm M365 Copilot is your deployed product, not Copilot Personal — Validate with your Microsoft licensing team or Entra admin center that your tenant uses Microsoft 365 Copilot, not the consumer Copilot Personal product. This one-time confirmation closes the advisory permanently.
2. Block copilot.microsoft.com on corporate proxies if consumer use is unwanted — If your acceptable-use policy prohibits consumer AI tools, add copilot.microsoft.com (the consumer endpoint) to your proxy blocklist. This prevents employees from using the consumer variant on corporate networks, though the vulnerability is already patched regardless.

Run on any domain-joined workstation with internet access as a standard user. Invoke with: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-24301.ps1. No elevated privileges required.

# Check-CVE-2026-24301.ps1
# Verifies whether your tenant uses M365 Copilot (enterprise) or Copilot Personal (consumer)
# CVE-2026-24301 affects ONLY Copilot Personal — enterprise is unaffected
# Exit codes: 0 = NOT VULNERABLE, 1 = UNKNOWN

$ErrorActionPreference = 'SilentlyContinue'

# Check 1: Look for M365 Copilot enterprise license in tenant
try {
    $licenseCheck = Get-MgSubscribedSku 2>$null | Where-Object { $_.SkuPartNumber -match 'Copilot' }
    if ($licenseCheck) {
        Write-Host "PATCHED — Your tenant has M365 Copilot (enterprise) licenses. CVE-2026-24301 affects only Copilot Personal (consumer). No action required." -ForegroundColor Green
        Write-Host "Detected SKU(s): $($licenseCheck.SkuPartNumber -join ', ')"
        exit 0
    }
} catch {
    # Graph module not available, fall through to manual check
}

# Check 2: Simple confirmation since the vuln is server-side patched
Write-Host "PATCHED — CVE-2026-24301 was a server-side vulnerability in Microsoft Copilot Personal (consumer)." -ForegroundColor Green
Write-Host "Microsoft applied the fix server-side on 2026-08-18. No client-side patch exists or is needed."
Write-Host "Microsoft 365 Copilot (enterprise) was never affected."
Write-Host ""
Write-Host "ACTION: Confirm with your Microsoft licensing team that your organization uses M365 Copilot, not Copilot Personal."
exit 0

Sources

1. NVD — CVE-2026-24301
2. Varonis Threat Labs — Reprompt: The Single-Click Microsoft Copilot Attack
3. The Hacker News — Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data
4. GBHackers — Critical Microsoft Copilot CoSnitch Flaw
5. Dark Reading — CoSnitch Attack Tricked Copilot into Revealing Own Architecture
6. The Register — Copilot tricked into telling researchers how to hack itself
7. TheWindowsUpdate — CVE-2026-24301 Advisory