Url redirection to untrusted site

CVE-2026-47645 is a classic CWE-601 open redirect in the URL-handling layer of Microsoft 365 Copilot's Business Chat (the M365-tenanted *BizChat* surface, not the consumer Copilot). An attacker crafts a chat or link that, when a user clicks, bounces them through a Copilot-controlled redirect endpoint to an attacker-controlled URL — useful as a phishing primer, OAuth consent stage, or token-grab funnel because the originating host is a trusted *.microsoft.com / *.cloud.microsoft domain. The affected component is the Microsoft-hosted Copilot service itself; there is no version range on customer infrastructure because there is no customer infrastructure to version. Microsoft documents the fix as an exclusively-hosted service update — already deployed.

Microsoft's HIGH / 8.8 label with C:H/I:H/A:H is the usual MSRC over-scoring for service-side Copilot bugs and *does not* match real-world impact. An open redirect that requires UI:R does not directly compromise confidentiality, integrity, or availability of anything in your tenant — it lends credibility to a phishing lure. The vendor score is inflated; the defender-relevant score is near zero because you cannot patch this and you do not need to.

Why this verdict

• No customer attack surface: the vulnerable endpoint is *.cloud.microsoft / Copilot service infrastructure. You do not host it, version it, or patch it.
• Microsoft has already remediated server-side per MSRC's exclusively-hosted-service classification — the bug is dead in the live service as of disclosure.
• Open redirect is a phishing accelerant, not an RCE. The C:H/I:H/A:H triad assumes a chained AiTM phishing campaign; the CVE itself does not compromise data, integrity, or availability of your tenant.
• UI:R is required — a user must click, and your existing Safe Links / SEG / FIDO2 stack is the actual control plane that matters.
• Role multiplier: the affected component is a *consumer-facing chat UI*, not identity (Entra), not a hypervisor, not a DC, not a CA, not backup, not a kernel agent, not network edge. No high-value-role floor applies — the deployment-role spectrum collapses to a single tenant-side UX surface that Microsoft already fixed.
• Not on KEV, no public PoC, no EPSS signal — no urgency drivers.

Why not higher?

A higher verdict would imply customer-side patching urgency or in-the-wild exploitation against your assets. Neither exists: Microsoft owns the patch surface, the fix is already deployed, and there is no KEV listing or campaign telemetry. The 8.8 HIGH vendor score is MSRC's standard scoring template for Copilot bugs, not a reflection of defender impact.

Why not lower?

We chose IGNORE rather than 'does not apply' because awareness still matters: defenders should make sure their Safe Links, FIDO2, and OAuth app-consent governance are healthy, since open-redirect-fueled phishing is a perennial vector. But there is no patch deadline, no compensating control SLA, and no detection rule unique to this CVE.

1. Document the CVE as 'vendor-remediated, no action' — Add to your vulnerability management exception register so audit/regulators see the rationale. No mitigation SLA applies — IGNORE bucket means document and move on.
2. Verify Safe Links and Safe Attachments are enabled tenant-wide — Safe Links time-of-click detonation neutralizes the entire class of open-redirect-fueled phishing, not just this CVE. Confirm coverage in Microsoft 365 Defender → Email & collaboration → Policies.
3. Enforce phishing-resistant MFA (FIDO2 / passkeys) on privileged accounts — If a chained AiTM phishing kit lands a user, FIDO2 defeats the credential and token capture. This is the actual control that matters for the broader open-redirect-into-AiTM threat model.
4. Restrict third-party OAuth app consent in Entra ID — Set 'Users can consent to apps from verified publishers, for selected permissions' or stricter. Open-redirect phishing often funnels into a malicious OAuth consent prompt; admin-consent workflows close that exit.

There is no on-host artifact to verify because this is a Microsoft-hosted service fix. Run this on any auditor workstation with Microsoft Graph PowerShell installed as a tenant Global Reader to confirm the *defender-relevant* compensating posture (Safe Links policy + Copilot tenant settings). Invocation: pwsh -File noisgate-CVE-2026-47645-posture.ps1 -TenantId <your-tenant-guid>. Requires Global Reader or Security Reader.

#!/usr/bin/env pwsh
# noisgate verification for CVE-2026-47645
# This CVE is a Microsoft-hosted service bug. There is no host-side version to check.
# Instead we verify the tenant-side compensating posture that actually matters.

param(
    [Parameter(Mandatory=$true)][string]$TenantId
)

$ErrorActionPreference = 'Stop'
$status = 'UNKNOWN'
$findings = @()

try {
    Import-Module Microsoft.Graph.Identity.SignIns -ErrorAction Stop
    Connect-MgGraph -TenantId $TenantId -Scopes 'Policy.Read.All','Directory.Read.All' -NoWelcome | Out-Null

    # 1. CVE artifact check — informational only
    Write-Host '[*] CVE-2026-47645 affects Microsoft-hosted Copilot BizChat. Fixed server-side by Microsoft. No customer patch.' -ForegroundColor Cyan

    # 2. Verify user OAuth consent policy is restricted
    $authPolicy = Get-MgPolicyAuthorizationPolicy
    if ($authPolicy.DefaultUserRolePermissions.PermissionGrantPoliciesAssigned -contains 'ManagePermissionGrantsForSelf.microsoft-user-default-low' -or `
        $authPolicy.DefaultUserRolePermissions.PermissionGrantPoliciesAssigned.Count -eq 0) {
        $findings += 'OAuth consent: RESTRICTED (good)'
    } else {
        $findings += 'OAuth consent: PERMISSIVE — tighten in Entra → Enterprise apps → Consent and permissions'
    }

    # 3. Hint at Safe Links posture (Exchange Online PS required for full check)
    $findings += 'Manual: confirm Safe Links policy is enabled tenant-wide via Get-SafeLinksPolicy in Exchange Online PowerShell'
    $findings += 'Manual: confirm Conditional Access enforces phishing-resistant MFA on privileged roles'

    $status = 'PATCHED'  # Microsoft already fixed the service-side bug
}
catch {
    Write-Error "Graph query failed: $_"
    $status = 'UNKNOWN'
}
finally {
    Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null
}

Write-Host ''
Write-Host "=== noisgate findings ===" -ForegroundColor Yellow
$findings | ForEach-Object { Write-Host " - $_" }
Write-Host ''
Write-Host "STATUS: $status" -ForegroundColor Green

switch ($status) {
    'PATCHED'    { exit 0 }
    'VULNERABLE' { exit 1 }
    default      { exit 2 }
}

Sources

1. MSRC advisory — CVE-2026-47645
2. NVD — CVE-2026-47645
3. The Hacker News — One-click M365 Copilot flaw coverage
4. Infosecurity Magazine — M365 Copilot zero-click AI flaw
5. Cybersecurity News — M365 Copilot vulnerability roundup
6. CISA KEV catalog
7. FIRST EPSS
8. OWASP CWE-601 Open Redirect