A critical vulnerability chain identified in early July 2026 demonstrates how the integration of AI assistants into enterprise environments creates new attack surfaces. The chain links an open redirect in Microsoft 365 Copilot (CVE-2026-41106) with an incorrect authorization flaw in Exchange Online (CVE-2026-54998) to achieve unauthenticated remote privilege escalation across an M365 tenant.
CVE-2026-41106, rated Critical with a CVSS score of 9.3, is an open redirect within the Copilot Business Chat interface. Open redirects are typically treated as low-severity issues. Here, the redirect serves as the initial vector in a chain that crosses service boundaries. CVE-2026-54998 (CVSS 8.8 High) is an incorrect authorization flaw in Exchange Online. Neither vulnerability alone achieves full tenant compromise. The attacker needs Copilot’s elevated trust position within the M365 ecosystem to bridge the gap between the initial redirect and the Exchange Online authorization failure.
The attack mechanism uses the open redirect to manipulate OAuth token flows or facilitate credential phishing. By leveraging Copilot’s service context, an attacker can move laterally, exploiting the Exchange Online flaw to gain unauthorized access to executive communications, AI-assisted workflows, and tenant-wide Exchange Online data — all without requiring legitimate customer-side credentials.
This chain is part of a broader cluster. CVE-2026-47645 is another open redirect in M365 Copilot Business Chat (CVSS 8.8). CVE-2026-26137 is a server-side request forgery (SSRF) vulnerability in the same component enabling privilege escalation. Three distinct vulnerability classes — open redirect, SSRF, and authorization bypass — all converging on the same attack surface suggests systematic security research into how the AI assistant interacts with underlying M365 services.
Microsoft applied server-side patches prior to the public disclosure on July 2, 2026, as part of its July Patch Tuesday cycle. No customer action is required. There are no confirmed reports of exploitation in the wild, and neither CVE appears in the CISA Known Exploited Vulnerabilities catalog.
The structural lesson is narrower than ‘AI is risky.’ When an AI assistant operates with elevated trust across a tenant — accessing email, calendar, files, and workflows — it becomes a bridge between attack surfaces that were previously isolated. An open redirect in a chatbot is a nuisance. An open redirect in a component that holds implicit authorization across Exchange, SharePoint, and Teams is a privilege escalation chain. The security model of the AI assistant is now the security model of the tenant.