The official record is one sentence: an "authorized attacker," a local path traversal in Azure Kubernetes Service, 8. 8 CVSS. The researchers who found the bug headlined it differently: "From AKS node root vulnerability to Microsoft Copilot hijack.
Source: [Dev.to](https://dev.to/secbyjasonmiller/cve-2026-32193-is-a-copilot-hijack-disguised-as-a-boring-path-traversal-6nf)