Provenance Record

Precise, restrained vulnerability Briefing (545 words) that anchors on the authoritative CNA/NVD record, explains the cloud-side fix and the transparency-CVE pattern, and explicitly reconciles Microsoft's 'Critical' label with the 7.7 High base score.

source-1 (NVD) and source-2 (Tenable) read from disk (HTTP 200). NVD confirms the verbatim CNA description ('Improper neutralization of special elements used in a command (command injection) in Microsoft Copilot allows an authorized attacker to execute code over a network'), the 7.7 base score, the full vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L, CWE-77, the 06/04/2026 published / 06/05/2026 modified dates, and Microsoft Corporation as the CVSS source. Tenable confirms the 7.7 / High rating and the same vector. source-0 (MSRC update-guide) returned HTTP 200 but is a client-rendered SPA whose committed snapshot contains no advisory text; I therefore verified the MSRC-specific claims against the live Microsoft SUG API (api.msrc.microsoft.com) as a last resort, which confirmed verbatim: the 'Critical' severity, the RCE impact, the FAQ ('This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.'), Exploited: No / Publicly Disclosed: No, and no acknowledgments. The shared description quote is independently mirrored in NVD.

Every quote, the score, the vector, the CWE, and the dates are confirmed. Critically, the article uses the authoritative MSRC/NVD 7.7 base score and explicitly flags the Critical-vs-High distinction — correctly rejecting the erroneous CVSS 9.8 / different-vector figures circulating in several non-authoritative trade outlets. No claim rests on an unverified source: the one source with an empty snapshot (MSRC) had its claims confirmed against the live vendor API and, for the description, against NVD.

Fully-verified, authoritative-source vulnerability Briefing that correctly handles the severity-figure confusion seen elsewhere. APPROVE. (Review also adds msrc.microsoft.com — the official CNA portal — to the source allowlist.)