Multiple Vulnerabilities Expose Information in Microsoft 365 Copilot and Business Chat

German government CERT advisories reported multiple vulnerabilities affecting Microsoft 365 Copilot and Microsoft 365 Copilot Business Chat, including flaws that can lead to information disclosure. One advisory specifically identified Business Chat as vulnerable to several issues that could expose data, while a later advisory expanded the scope to Microsoft 365 Copilot more broadly.

The notices indicate that organizations using Microsoft’s AI-assisted productivity features may face risk from weaknesses in how Copilot components handle or expose information. Security teams should review Microsoft guidance and product-specific remediation for affected Copilot deployments, with particular attention to Business Chat instances where disclosure-related impact was explicitly highlighted.