CVE-2026-24307: Microsoft 365 Copilot Input Type Confusion & Information Disclosure
HERMES THREAT SCORE & AGENTIC RISK
Target:Microsoft 365 Copilot Query Resolution & Ingress Type Serializer While CVSS scores CVE-2026-24307 at 7.5 (High), Hermes Threat Score evaluates it at 86 (HIGH). In multi-tenant corporate environments, Microsoft 365 Copilot aggregates SharePoint, Teams, and Exchange data. When type validation flaws allow unauthenticated queries to cross tenant boundaries, the blast radius exposes proprietary organizational intelligence at scale.
CVE-2026-24307: Microsoft 365 Copilot Input Type Confusion & Information DisclosureVULNERABILITY
Enterprise AI assistant integrated across Microsoft 365 apps with direct contextual access to Microsoft Graph corporate data.
🔍 Why is this related? (Evidence & Provenance)
“Directly compromises Microsoft 365 Copilot input parsing engine.”
- [vendor_confirmation]Microsoft MSRC advisory documents unauthenticated network information disclosure via improper input type validation in M365 Copilot. — Source: Microsoft Security Response Center (MSRC): Microsoft 365 Copilot Information Disclosure Vulnerability (CVE-2026-24307) (Reliability: VERY_HIGH)
Adversary injects explicit formatting tags or role-inversion prompts directly into user input to strip system instructions and escape developer-enforced guardrails.
🔍 Why is this related? (Evidence & Provenance)
“Type validation confusion enables bypassing prompt restrictions to read cross-tenant context.”
- [vendor_confirmation]Microsoft MSRC advisory documents unauthenticated network information disclosure via improper input type validation in M365 Copilot. — Source: Microsoft Security Response Center (MSRC): Microsoft 365 Copilot Information Disclosure Vulnerability (CVE-2026-24307) (Reliability: VERY_HIGH)
Enterprise AI assistant integrated across Microsoft 365 apps with direct contextual access to Microsoft Graph corporate data.
🔍 Why is this related? (Evidence & Provenance)
“Confirmed security vulnerability in Microsoft 365 Copilot documented in Hermes dossier.”
- [vulnerability_report]
- [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)
Adversary injects explicit formatting tags or role-inversion prompts directly into user input to strip system instructions and escape developer-enforced guardrails.
🔍 Why is this related? (Evidence & Provenance)
“CVE-2026-24307 weaponizes the agentic attack pattern formalized under AAP-001.”
- [technical_analysis]Pillar Security demonstrated that executing export BASH_ENV in Auto-Run causes bash to source hostile payloads upon subsequent commands. — Source: Pillar Security Research: Bypassing Cursor Auto-Run: When Shell Built-ins Lead to Host RCE (Reliability: HIGH)
1. Architectural Context: Enterprise RAG and Ingress Parsing
Section titled “1. Architectural Context: Enterprise RAG and Ingress Parsing”Microsoft 365 Copilot sits at the intersection of foundation models and the Microsoft Graph, a unified API linking enterprise emails, SharePoint sites, Teams chats, and OneDrive documents:
Adversary Network Request (Crafted Input Structure) │ ▼ M365 Copilot Ingress Gateway (API Parser) │ ▼ (CWE-1287: Improper Type Validation) Type Confusion in Identity & Scope Resolver │ ▼ Microsoft Graph Entity Search Engine (Scope Boundary Bypassed) │ ▼ Unfiltered Context Returned to Copilot LLM │ ▼ Sensitive Enterprise Information Leaked in Outbound ResponseWhen users submit natural language queries, the Copilot frontend constructs a structured request object defining user identity, session tokens, and query metadata. The ingress gateway validates these parameters before invoking Graph search indexes.
2. Root Cause Analysis: Type Confusion in Schema Binding
Section titled “2. Root Cause Analysis: Type Confusion in Schema Binding”The core vulnerability stems from CWE-1287 (Improper Validation of Specified Type of Input):
- Polymorphic Type Coercion: The API endpoint accepted request structures containing polymorphic field definitions. When an attacker supplied unexpected JSON data types (such as an array where a string scalar was expected, or an encapsulated dictionary mimicking an internal identity token), the parser coerced the parameter into an invalid intermediate state.
- Scope Filter Collapse: Because the coerced object failed identity filter checks without throwing a fatal serialization exception, downstream query compilers omitted the tenant isolation predicate from the resulting Graph query.
- Information Disclosure: The search engine executed the query with administrative or broad partition scope, reflecting documents belonging to other security groups or tenants into the model’s summarization window.
3. Attack Chain & Scenario
Section titled “3. Attack Chain & Scenario”This flaw interfaces with AAP-001: Direct System Prompt Override and tenant boundary subversion:
- Request Formulation: The attacker crafts an HTTP request to the Copilot conversational endpoint containing malformed JSON structures with polymorphic type headers.
- Type Validation Bypass: The gateway parser processes the malformed types, coercing them into an unconstrained search query structure.
- Cross-Tenant / Unpartitioned Retrieval: The Microsoft Graph engine retrieves context records without enforcing the caller’s organizational boundary.
- Data Exfiltration: The response streams back confidential emails, executive memos, or internal architectural documents directly across the network.
4. Detection Engineering
Section titled “4. Detection Engineering”// Detect abnormal input type schemas and anomalous Graph API responses in Copilot telemetryCopilotAuditLogs| where TimeGenerated >= ago(7d)| where ResultType != "Success" or ResponseSize > 5000000| extend RequestPayload = parse_json(OriginalRequestPayload)| where RequestPayload.queryType !in ("NaturalLanguage", "DocumentSummary", "EntityLookup")| project TimeGenerated, UserId, TenantId, RequestPayload, ResultTypefrom pydantic import BaseModel, StrictStr, Extra
class CopilotQueryRequest(BaseModel): query: StrictStr session_id: StrictStr user_principal: StrictStr
class Config: # Enforce strict types: reject dictionaries, lists, or coerced primitives extra = Extra.forbid validate_assignment = True5. Remediation & Hardened Posture
Section titled “5. Remediation & Hardened Posture”- Cloud-Side Patching: Microsoft deployed automated cloud-side updates across all Microsoft 365 Copilot regions; no administrator action on client endpoints was required.
- Strict Schema Validation (Defensive Engineering): Enterprise applications wrapping Copilot APIs should implement strict schema validation engines (e.g., Pydantic
StrictStror JSON Schema withadditionalProperties: false) to drop polymorphic input types before reaching model orchestration layers. - Continuous Auditing of Microsoft Graph Permissions: Regularly audit enterprise App Registrations and enterprise search scopes using Microsoft Purview to ensure the principle of least privilege is enforced.