CVE-2026-41106

CriticalCVSS 9.3/10Last modified Jul 7, 2026

Description

Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.

Metrics

CVSS 3.1 9.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published
Jul 2, 2026
Last modified
Jul 7, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-411077.4External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a netwCVE-2026-411087.0Heap-based buffer overflow in Microsoft Windows DNS allows an authorized attacker to elevate privileges locally.CVE-2026-411098.8Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allowCVE-2026-41117.5A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processCVE-2026-411138.1sagredo qmail before 2026.04.07 allows tls_quit remote code execution because of popen in notlshosts_auto in qmail-remote.c.CVE-2026-41114Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver. This issue affects Apache IoTDB JDBC driver: from 1.3.3 befoCVE-2026-411154.3An improper authorization vulnerability has been identified in Apache Kafka. The implementation of the CONSUMER_GROUP_DESCRIBE (69) API valCVE-2026-411166.3Dell Inventory Collector Client, versions prior to 13.8.0, contain an Improper Link Resolution Before File Access ('Link Following') vulneraCVE-2026-411196.8Dell Live Optics Windows and Personal Edition collectors contain an improper certificate validation vulnerability. A remote unauthenticated CVE-2026-41127.2Improper neutralization of special elements used in an SQL command (“SQL Injection”) in SonicWall SMA1000 series appliances allows a remote CVE-2026-411209.8Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trusted Data vulnerabilitCVE-2026-411217.8Dell Device Management Agent, versions prior to DDMA 26.05, contain an Improper Link Resolution Before File Access ('Link Following’) vulner
CVE-2026-41106: Critical severity, CVSS 9.3 | Vulnix