Riskcovery

CVE-2026-26133

M365 Copilot Information Disclosure Vulnerability

State
Published
Severity
7.1 High
Published
Mar 13, 2026
Updated
Jun 19, 2026
Reserved
Feb 11, 2026

Read the record on cve.org

Description

AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Scores

CVSSScoreVectorSource
3.17.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N/E:U/RL:O/RC:Cmicrosoft

Weaknesses

  • CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Affected Products

ProductVersions
Microsoft 365 Copilot for AndroidMicrosoft
  • 1.0 to before 16.0.19815.10000Affected
Microsoft 365 Copilot for iOSMicrosoft
  • 1.0 to before 2.107.2Affected
Microsoft Edge for AndroidMicrosoft
  • 1.0.0 to before 145.3800.99Affected
Microsoft Edge for iOSMicrosoft
  • 1.0.0.0 to before 145.3800.99Affected
Microsoft Excel for AndroidMicrosoft
  • 16.0.0.0 to before 16.0.19822.20038Affected
Microsoft Excel for iOSMicrosoft
  • 1.0 to before 2.106.26020617Affected
Microsoft Loop for iOSMicrosoft
  • 2.0.0 to before 2.106.26020617Affected
Microsoft OneNoteMicrosoft
  • 1.0.0 to before 2.106.26020617Affected
Microsoft OneNote for AndroidMicrosoft
  • 16.0.1 to before 16.0.19725.20142Affected
Microsoft Outlook for AndroidMicrosoft
  • 1.0 to before 5.2605Affected
Microsoft Outlook for iOSMicrosoft
  • 1.0.0 to before 5.2605Affected
Microsoft Outlook for MacMicrosoft
  • 1.0.0 to before 5.2605Affected
Microsoft PowerBI for AndroidMicrosoft
  • 2.0.0 to before 2.2.260210.21290750Affected
Microsoft PowerBI for iOSMicrosoft
  • 1.0.0 to before 1.2.260302.2193910Affected
Microsoft PowerPoint for AndroidMicrosoft
  • 16.0.0.0 to before 16.0.19822.20038Affected
Microsoft PowerPoint for iOSMicrosoft
  • 1.0 to before 2.106.26020617Affected
Microsoft Teams for AndroidMicrosoft
  • 1.0.0 to before 1.0.0.2026043102Affected
Microsoft Teams for iOSMicrosoft
  • 2.0.0 to before 8.3.1Affected
Microsoft Word for AndroidMicrosoft
  • 16.0.0.0 to before 16.0.19822.20038Affected
Microsoft Word for iOSMicrosoft
  • 2.0.0 to before 2.106.26020617Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.