Critical CVEs

CVE-2026-41106 — Critical vulnerability brief

July 2, 2026CVSS 9.3

Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.

CVSS base score: 9.3 / 10