CVE-2026-47645 Overview
CVE-2026-47645 is an open redirect vulnerability in Microsoft 365 Copilot's Business Chat. The flaw allows an unauthorized attacker to elevate privileges over a network when a victim interacts with a crafted link. The weakness is categorized as URL redirection to an untrusted site [CWE-601]. Successful exploitation requires user interaction but no prior authentication. Microsoft has published an advisory through the Microsoft Security Response Center.
Critical Impact
An unauthenticated attacker can redirect users from a trusted Microsoft 365 Copilot Business Chat context to an attacker-controlled site, enabling privilege escalation and compromise of confidentiality, integrity, and availability.
Affected Products
- Microsoft 365 Copilot
- Microsoft 365 Copilot Business Chat
- Microsoft 365 cloud productivity services integrating Copilot Business Chat
Discovery Timeline
- 2026-06-19 - CVE-2026-47645 published to the National Vulnerability Database (NVD)
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-47645
Vulnerability Analysis
The vulnerability resides in how Microsoft 365 Copilot's Business Chat handles URL redirection. The service accepts user- or attacker-supplied URL parameters and forwards browsers to those destinations without sufficient validation against an allow list. Because the redirect originates from a Microsoft 365 domain, victims see a trusted origin before being sent to attacker-controlled infrastructure.
The vulnerability is classified under [CWE-601], URL Redirection to Untrusted Site. Open redirects in AI assistant surfaces are particularly impactful because Copilot rendering of links carries implicit trust. Attackers can chain the redirect with credential phishing, OAuth consent abuse, or token theft to escalate privileges within the victim's tenant.
Root Cause
The root cause is insufficient validation of redirect target URLs inside the Business Chat component. The application trusts inbound URL parameters and constructs HTTP responses that send the user agent to an arbitrary external host. No domain allow list or signed redirect token blocks attacker-supplied destinations.
Attack Vector
The attack vector is network-based and requires user interaction. An attacker crafts a malicious link that abuses the Copilot Business Chat redirect endpoint, then delivers the link through email, chat, or AI prompt injection in shared documents. When the victim follows the link, the trusted Microsoft 365 origin redirects them to an attacker-controlled site that harvests credentials, session tokens, or OAuth consent grants. The captured artifacts are then used to elevate privileges within the victim's Microsoft 365 environment.
No verified public proof-of-concept code is available. See the Microsoft CVE-2026-47645 advisory for vendor technical details.
Detection Methods for CVE-2026-47645
Indicators of Compromise
- Outbound HTTP referrers originating from Microsoft 365 Copilot Business Chat URLs followed by redirects to non-Microsoft domains.
- Unexpected OAuth consent grants, token issuance events, or session sign-ins from new geolocations following Copilot link interactions.
- User reports of Copilot-generated links that resolved to unfamiliar credential prompts or download pages.
Detection Strategies
- Inspect web proxy and secure web gateway logs for redirect chains beginning at Microsoft 365 Copilot endpoints and terminating at uncategorized external domains.
- Correlate Microsoft Entra ID sign-in logs with Copilot interaction telemetry to surface anomalous authentication events after link clicks.
- Hunt for phishing campaigns referencing Copilot or Business Chat URLs in mail flow and collaboration platforms.
Monitoring Recommendations
- Enable Microsoft 365 audit logging for Copilot interactions and review URL artifacts surfaced to users.
- Forward Microsoft 365, Entra ID, and proxy logs into a centralized SIEM for cross-source correlation.
- Monitor for anomalous OAuth application consent and token refresh activity within the tenant.
How to Mitigate CVE-2026-47645
Immediate Actions Required
- Apply the Microsoft fix referenced in the MSRC update guide for CVE-2026-47645 as soon as it is available in your tenant.
- Notify users that links rendered inside Copilot Business Chat can be abused and instruct them to verify destinations before authenticating.
- Review recent OAuth consent grants and revoke any unrecognized application permissions.
Patch Information
Microsoft addresses CVE-2026-47645 through a service-side update to Microsoft 365 Copilot Business Chat. Because Copilot is a cloud-delivered service, remediation is rolled out by Microsoft and does not require customer-side binary updates. Refer to the Microsoft CVE-2026-47645 Update for tenant-specific guidance and rollout status.
Workarounds
- Enforce phishing-resistant multifactor authentication and conditional access policies to limit the value of stolen sessions.
- Restrict outbound traffic from corporate browsers to known-good categories using a secure web gateway until the patch is confirmed deployed.
- Disable or scope Microsoft 365 Copilot Business Chat for high-risk user groups until vendor remediation is verified.
# Example: Audit recent OAuth consent grants in Microsoft Entra ID
Connect-MgGraph -Scopes "Directory.Read.All","AuditLog.Read.All"
Get-MgAuditLogDirectoryAudit -Filter "activityDisplayName eq 'Consent to application'" \
| Sort-Object ActivityDateTime -Descending \
| Select-Object ActivityDateTime, InitiatedBy, TargetResources
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
