CVE-2026-26164: Improper neutralization of special elements in output used by a downstream component ('injection') in M365 Copilot allow

CVE-2026-26164 is a vulnerability in Microsoft 365 Copilot caused by improper neutralization of special elements in output (a type of injection attack, where specially crafted input can be misinterpreted as commands). An attacker without authorization could exploit this to access and disclose information over a network.