CVE-2026-59118

This vulnerability is like someone getting a “manager-only” key because the door guard doesn’t properly check permissions. An attacker can’t log in themselves, but they can take advantage of what a user does (like clicking a link) to gain higher access and then change or read important information inside the system.

This matters if your business uses Microsoft Copilot Cowork (and/or power apps) where users interact with the app over the network. The attacker does not need to have an account in advance, but the attack requires a user action (such as clicking a link or interacting with the service).

This is RED because the issue is a permission/authorization failure that can lead to privilege escalation and data tampering, and it has been tied to elevated threat attention (including reporting involving Lazarus group). Act immediately to get the Microsoft-published fix applied for your Copilot Cowork setup.

1. Confirm exposure in your environment

   • Inventory where Copilot Cowork and power apps are in use (internal users, shared links, embedded experiences, and any external-facing entry points).
   • Identify which tenant(s) and deployment settings those experiences use.

2. Determine the correct fixed update

   • Use Microsoft’s update guide page for CVE-2026-59118 (msrc.microsoft.com update guide) to find the fixed version(s) relevant to your configuration.
   • If your setup is a service managed by Microsoft, follow the guide’s instructions for what is being updated and how you verify your environment is on the fixed state.

3. Apply remediation

   • Upgrade/apply the fix exactly as Microsoft specifies for Copilot Cowork (and any related power apps components if included in the guidance).
   • Keep a short record: before/after version/state and the deployment date.

4. Temporary risk reduction (if patching is delayed)

   • Limit access to Copilot Cowork/power apps from untrusted networks where feasible.
   • Reduce the chance of successful user-triggered interactions by tightening email/link security and user guidance (e.g., discourage clicking unexpected links that lead into the app).

5. What to monitor after the update

   • Monitor for unexpected permission changes, anomalous actions taken immediately after user interactions, and unusual access patterns to sensitive areas.
   • Review logs around times users clicked/used links in Copilot Cowork to ensure no unauthorized privilege changes occurred.

CVE-2026-59118 is a CWE-285 authorization flaw in Copilot Cowork (and related power apps usage). The core mechanism is insufficient permission checks that allow an unauthorized attacker (no prior authentication required) to gain higher-level access rights when a user interacts with the vulnerable application over the network (network attack vector with user interaction required).

Verdict is RED. While CISA KEV does not list this item, threat attention has been reported (PULSE notes sustained patch-related attention and actor Lazarus group). No public exploit code was found on record, and KEV status is not confirmed here; therefore, exploitation details are not claimed beyond the vulnerability’s authorization-elevation mechanism.