CVE-2026-80098: Critical Copilot Studio Signature Verification Flaw (CVSS 9.3) — Detection and Remediation Guide

On publication to the National Vulnerability Database, CVE-2026-80098 landed with a CVSS base score of 9.3 (CRITICAL) and a network attack vector — the combination that should immediately trigger your emergency triage workflow. The vulnerability resides in Microsoft Copilot Studio, the low-code platform enterprises use to build and deploy custom copilots and agents across Microsoft 365, Teams, and external-facing channels. The flaw is an improper verification of a cryptographic signature (CWE-347), which allows an unauthorized attacker to elevate privileges over the network — no prior authentication to the vulnerable component required.

If your organization builds, hosts, or publishes copilots through Copilot Studio — particularly any agents exposed to external users or unauthenticated channels — you are in scope. Copilot Studio agents frequently hold delegated permissions against Dataverse, SharePoint, Microsoft Graph, and third-party connectors. A privilege escalation inside that trust boundary is not a contained event; it is a potential pivot into your entire Power Platform and Microsoft 365 estate.

This post breaks down what we know, how to hunt for abuse, and what to do in the next 24–72 hours.

Technical Analysis

Affected Component

How the Vulnerability Works (Defender's View)

CWE-347 flaws occur when a service accepts a signed token, assertion, or payload without properly validating the signature — or validates it against the wrong key, accepts an alg=none variant, fails to check issuer/audience claims, or skips signature validation entirely on some code path.

In a platform like Copilot Studio, signed artifacts are everywhere: authentication tokens for agent sessions, signed requests between the Copilot Studio runtime and Dataverse/connectors, and identity assertions used when an agent acts on behalf of a user or service principal. An improper signature verification flaw in this chain means an attacker positioned on the network can present a forged or tampered token/assertion that the service accepts as legitimate, and in doing so assume privileges they were never granted.

Practically, the exploitation chain a defender should model looks like this:

1. Reconnaissance — attacker identifies an internet-reachable Copilot Studio endpoint (published copilots, demo/web channel endpoints, or embedded agents on public sites).
2. Token forgery — attacker crafts a token or signed request that exploits the broken verification path (e.g., altered claims, invalid/self-generated signature, or signature stripped entirely).
3. Privilege assumption — the service accepts the forged assertion and processes the request under an elevated or different security context than the attacker's.
4. Post-exploitation — with elevated context, the attacker interrogates connected data sources via the agent's connectors: Dataverse tables, SharePoint content, Graph API calls, or downstream SaaS integrations the copilot is wired into.

The critical point for defenders: the agent's configured permissions become the blast radius. A customer-facing FAQ bot with read access to a knowledge base is a nuisance. An agent wired to Dataverse with create/update rights on business tables, or one using a maker's broadly-scoped connection references, is a breach.

Exploitation Status

At the time of writing, the NVD entry reflects initial publication. There is no confirmed public proof-of-concept exploit and no CISA KEV listing yet — but treat that as a window, not a comfort. CVSS 9.3 network-exploitable privilege escalation in a Microsoft cloud service will attract immediate researcher attention and reverse-engineering of any service-side fixes. Monitor the following over the coming days:

• NVD entry for reference enrichment
• Microsoft Security Response Center (MSRC) advisory for CVE-2026-80098
• CISA Known Exploited Vulnerabilities catalog
• The Microsoft 365 / Power Platform admin center message center for service health advisories

Because Copilot Studio is a Microsoft-operated SaaS, remediation is largely applied server-side by Microsoft — but that does not mean your work is done. Your exposure depends on configuration choices you own: which copilots are published, which channels they're exposed on, what permissions their connectors carry, and whether you can detect anomalous use.

Detection & Response

This is a technical threat, and the hunt surface here is primarily Entra ID / Power Platform telemetry, not endpoint artifacts. The rules below target the behaviors a successful exploit would generate: anomalous token issuance and sign-in patterns against Power Platform resources, unexpected Copilot Studio activity from unfamiliar networks, and sudden connector/Dataverse operations from agents that should be idle or narrowly scoped.

Sigma Rules

---
title: Anomalous Sign-in to Power Platform or Copilot Studio Resource
description: Detects sign-ins to Power Platform / Copilot Studio resources from unfamiliar locations or with token anomalies, consistent with forged-assertion abuse of a signature verification flaw such as CVE-2026-80098.
logsource:
  product: azure
  service: signinlogs
detection:
  selection_resource:
    ResourceDisplayName|contains:
      - 'Power Platform'
      - 'Copilot Studio'
      - 'Power Virtual Agents'
      - 'Dataverse'
  selection_anomaly:
    RiskLevelDuringSignIn:
      - 'high'
      - 'medium'
    TokenIssuerType|contains:
      - 'unknown'
  condition: selection_resource and selection_anomaly
falsepositives:
  - Users traveling or on VPN egress points flagged by Entra ID Protection
  - New conditional access policy rollouts changing token issuance patterns
level: high
---
title: Copilot Studio Agent Activity From Unusual Network Source
description: Detects Copilot Studio / Power Platform audit events originating from IP addresses outside expected corporate egress ranges, a potential indicator of unauthorized network-based access following privilege escalation via CVE-2026-80098.
logsource:
  product: azure
  service: auditlogs
detection:
  selection_workload:
    Workload|contains:
      - 'PowerPlatform'
      - 'PowerVirtualAgents'
      - 'CopilotStudio'
  selection_suspicious_ip:
    ClientIP|startswith:
      - '1.'
      - '2.'
      - '5.'
  filter_corporate_egress:
    ClientIP|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
  condition: selection_workload and selection_suspicious_ip and not filter_corporate_egress
falsepositives:
  - Makers and admins working from home networks — tune the suspicious IP list to exclude known ISP ranges or replace with a watchlist of approved egress IPs
level: medium

KQL — Microsoft Sentinel / Defender

The following hunt assumes you are ingesting Entra ID sign-in logs and Power Platform / Microsoft 365 audit logs into Sentinel. It looks for the post-exploitation signature: a burst of Dataverse or connector operations from a copilot/agent identity that deviates from its baseline, or sign-ins to Power Platform resources with anomalous token properties.

// Hunt 1: Anomalous token/sign-in characteristics against Power Platform resources
let lookback = 7d;
SigninLogs
| where TimeGenerated > ago(lookback)
| where ResourceDisplayName has_any ("Power Platform", "Copilot Studio", "Power Virtual Agents", "Dataverse")
| extend TokenAnomaly = iff(
    RiskLevelDuringSignIn in ("high", "medium")
    or IsRisky == true
    or AuthenticationRequirement == "singleFactorAuthentication" and Location !in ("US"), // tune Location to your expected geographies
    1, 0)
| where TokenAnomaly == 1
| summarize SignInCount = count(),
            DistinctIPs = dcount(IPAddress),
            IPs = make_set(IPAddress, 10),
            Apps = make_set(AppDisplayName, 10),
            FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated)
    by UserPrincipalName, ResourceDisplayName, ResultType
| sort by LastSeen desc;

// Hunt 2: Copilot/agent identity performing Dataverse or connector operations outside baseline
let lookback = 14d;
let baseline_window = 30d;
let baseline =
    CloudAppEvents
    | where TimeGenerated between (ago(baseline_window) .. ago(lookback))
    | where Application has_any ("Power Platform", "Power Virtual Agents", "Copilot")
    | summarize BaselineAvg = count() by AccountObjectId, bin(TimeGenerated, 1d)
    | summarize AvgDailyOps = avg(BaselineAvg) by AccountObjectId;
CloudAppEvents
| where TimeGenerated > ago(lookback)
| where Application has_any ("Power Platform", "Power Virtual Agents", "Copilot")
| where ActionType has_any ("CreateRecord", "UpdateRecord", "DeleteRecord", "RetrieveMultiple", "ExecuteConnector")
| summarize CurrentOps = count(), Actions = make_set(ActionType, 15) by AccountObjectId, AccountDisplayName, bin(TimeGenerated, 1d)
| join kind=leftouter baseline on AccountObjectId
| extend Deviation = CurrentOps - coalesce(AvgDailyOps, 0.0)
| where Deviation > 50 or isnull(AvgDailyOps)  // spike, or identity with no 30-day baseline (new/never-seen activity)
| sort by Deviation desc;

Tune the Location, deviation threshold, and application name strings against your tenant's actual display names — Power Platform resource naming varies slightly by licensing SKU and log source version.

Velociraptor VQL

For SaaS-side compromise, endpoint forensics are secondary — but if you suspect a forged-token attack was staged or tested from an internal host (e.g., a developer workstation experimenting with token manipulation against your own copilots), hunt for tooling and browser/CLI interaction with Copilot Studio endpoints.

-- Hunt for processes and network connections interacting with Copilot Studio / Power Platform endpoints
-- Useful for identifying hosts forging or replaying tokens against copilot environments
LET endpoints = '(copilotstudio|powerva|powervirtualagents|dynamics\.com/api|environment.*\.powerplatform)'

SELECT Pid,
       Name,
       CommandLine,
       Exe,
       Username,
       CreateTime
FROM pslist()
WHERE CommandLine =~ endpoints
   OR Exe =~ '(curl|wget|python|powershell|pwsh|node)\.exe$'
      AND CommandLine =~ endpoints

-- Correlate with live outbound connections to Power Platform service ranges
SELECT Pid,
       Name,
       Path,
       Netstat.RemoteAddress AS RemoteIP,
       Netstat.RemotePort AS RemotePort,
       Netstat.Status AS ConnStatus
FROM netstat()
WHERE RemotePort = 443
  AND Name =~ '(curl|python|node|powershell|pwsh)'

Use this as a scoped hunt across developer workstations and build agents — not a fleet-wide continuous artifact, or you will drown in legitimate automation traffic.

Remediation / Verification Script

Because the fix is applied server-side by Microsoft, your scriptable work is exposure inventory and configuration hardening: enumerate every published copilot, identify which are exposed on unauthenticated channels, and flag agents whose connectors carry write-capable permissions.

# CVE-2026-80098 - Copilot Studio Exposure Inventory & Hardening Audit
# Requires: Microsoft.PowerApps.Administration.PowerShell, Microsoft.PowerApps.PowerShell
# Run as a Power Platform admin. Review output before taking action.

Install-Module -Name Microsoft.PowerApps.Administration.PowerShell -Force -Scope CurrentUser
Add-PowerAppsAccount

# 1. Enumerate all environments
$environments = Get-AdminPowerAppEnvironment
Write-Output "=== Environments in scope ==="
$environments | Select-Object DisplayName, EnvironmentName, EnvironmentType | Format-Table -AutoSize

# 2. Inventory all copilots (bots) across environments
$report = foreach ($env in $environments) {
    $bots = Get-AdminPowerVirtualAgentBot -EnvironmentName $env.EnvironmentName -ErrorAction SilentlyContinue
    foreach ($bot in $bots) {
        [PSCustomObject]@{
            Environment     = $env.DisplayName
            EnvironmentType = $env.EnvironmentType
            BotName         = $bot.DisplayName
            BotId           = $bot.BotId
            IsPublished     = $bot.IsPublished
            CreatedTime     = $bot.CreatedTime
            Owner           = $bot.Owner
        }
    }
}

# 3. Export inventory for triage - prioritize published bots in Default/production environments
$report | Sort-Object IsPublished -Descending | Format-Table -AutoSize
$report | Export-Csv -Path ".\CopilotStudio_Exposure_Inventory_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

# 4. Flag high-risk findings for immediate review
Write-Output "`n=== HIGH RISK: Published copilots (verify authentication is enforced on all channels) ==="
$report | Where-Object { $_.IsPublished -eq $true } | Format-Table -AutoSize

Write-Output "`nACTION ITEMS:`n - For each published copilot: open Copilot Studio > Settings > Security > Authentication`n - Confirm 'Only for Teams and Power Apps' or Entra ID auth is set - NOT 'No authentication'`n - Review each copilot's connectors for write-capable Dataverse/Graph permissions`n - Audit sharing: ensure copilots are not shared with 'Everyone in the organization' unless intended"

Remediation

1. Apply Microsoft's Service-Side Fix — and Confirm It

Copilot Studio is SaaS; Microsoft deploys the patch to the service. Your responsibility is confirmation:

• Watch the MSRC advisory for CVE-2026-80098 for the deployment status and any tenant-side actions required.
• Check the Power Platform admin center and Microsoft 365 Message Center for advisory MC posts related to this CVE.
• If Microsoft indicates per-environment rollout, verify your production environments show as updated before standing down emergency monitoring.

2. Enforce Authentication on Every Published Copilot (Immediate)

The single highest-leverage configuration control: no copilot should accept unauthenticated sessions unless it is deliberately designed as a public, zero-permission FAQ agent. In Copilot Studio:

• Navigate to Settings → Security → Authentication.
• Set authentication to "Only for Teams and Power Apps" or "Manually (with Microsoft Entra ID)" for any internal-facing agent.
• Treat "No authentication" as a finding requiring documented business justification and a zero-permission connector posture.

3. Reduce the Blast Radius of Agent Permissions

The exploit elevates privileges within the agent's trust context — so shrink the context:

• Audit every connector and connection reference used by your copilots. Remove write-capable Dataverse privileges from agents that only need read.
• Replace maker-owned broad connections with dedicated least-privilege service principals scoped to exactly the tables and endpoints the agent needs.
• For copilots calling Microsoft Graph or custom APIs, enforce audience/scope restriction on the app registration — an agent that only reads SharePoint knowledge articles should hold Sites.Read.All-equivalent minimums, nothing more.

4. Harden the Power Platform Governance Layer

• Apply Data Loss Prevention (DLP) policies in the Power Platform admin center to block high-risk connectors (HTTP, custom connectors to arbitrary endpoints) from copilot-bearing environments.
• Segment environments: development copilots in a sandbox environment, production agents in a managed environment with restricted sharing.
• Review copilot sharing settings — remove "Everyone in the organization" grants that are not deliberate.

5. Enable and Centralize Telemetry

• Confirm Power Platform audit logging is enabled in the Microsoft Purview compliance portal and flowing to your SIEM.
• Ensure Entra ID sign-in and risk detections cover Power Platform service principals and resources.
• Deploy the detection content above with tuned baselines before exploitation PoCs surface — CVSS 9.3 network flaws in Microsoft cloud services have a historically short gap between disclosure and weaponization.

6. Monitor for Escalation of Exploitation Status

• Subscribe to changes on the NVD entry.
• Watch the CISA KEV catalog — if this CVE is added, federal deadlines (typically 21 days for civilian agencies) are a good forcing function even for private-sector prioritization.
• Track MSRC and reputable threat intel feeds for PoC publication.

Bottom Line

CVE-2026-80098 is exactly the class of vulnerability that punishes configuration debt. Microsoft will patch the signature verification flaw server-side, but the damage potential in your tenant is defined by choices you made long before disclosure: unauthenticated copilots, over-permissioned connectors, and unaudited agent activity. Use this disclosure as the forcing function to inventory your Copilot Studio estate, enforce authentication everywhere, and stand up detection for anomalous agent behavior — because when a PoC drops, the organizations that did that work will be watching their hunts instead of rebuilding trust boundaries.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub