CVE-2026-26133
highpriority · track · 0EPSS 0.004 · 38 %ileDEEUUSEPSS · scored 2026-10-27
AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedMicrosoft 365 Copilot for Androidmsrc_csaf
16.0.19815.10000:Security Update:https://play.google.com/store/search?q=copilot+365&c=apps
https://play.google.com/store/search?q=copilot+365&c=apps - FixedMicrosoft 365 Copilot for iOSmsrc_csaf
2.107.2:Security Update:https://apps.apple.com/us/app/microsoft-365-copilot/id541164041
https://apps.apple.com/us/app/microsoft-365-copilot/id541164041 - FixedMicrosoft Edge for Androidmsrc_csaf
145.3800.99:Security Update:https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security
https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security - FixedMicrosoft Edge for iOSmsrc_csaf
145.3800.99:Security Update:https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security
https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security - FixedMicrosoft Excel for Androidmsrc_csaf
16.0.19822.20038:Security Update:https://play.google.com/store/apps/details?id=com.microsoft.office.excel&hl=en_US
https://play.google.com/store/apps/details?id=com.microsoft.office.excel&hl=en_US - FixedMicrosoft Excel for iOSmsrc_csaf
2.106.26020617:Security Update:https://apps.apple.com/us/app/microsoft-excel/id586683407?platform=mac
https://apps.apple.com/us/app/microsoft-excel/id586683407?platform=mac - FixedMicrosoft Loop for iOSmsrc_csaf
2.106.26020617:Security Update:https://apps.apple.com/us/app/microsoft-loop/id1637682491
https://apps.apple.com/us/app/microsoft-loop/id1637682491 - FixedMicrosoft OneNote for Androidmsrc_csaf
16.0.19725.20142:Security Update:https://play.google.com/store/apps/details?id=com.microsoft.office.onenote
https://play.google.com/store/apps/details?id=com.microsoft.office.onenote - FixedMicrosoft OneNote for iOSmsrc_csaf
2.106.26020617:Security Update:https://apps.apple.com/us/app/microsoft-onenote/id410395246?platform=mac
https://apps.apple.com/us/app/microsoft-onenote/id410395246?platform=mac - FixedMicrosoft Outlook for Androidmsrc_csaf
5.2605:Security Update:https://learn.microsoft.com/en-us/officeupdates/release-notes-outlook-mobile
https://learn.microsoft.com/en-us/officeupdates/release-notes-outlook-mobile - FixedMicrosoft Outlook for Macmsrc_csaf
5.2605:Security Update:https://go.microsoft.com/fwlink/p/?linkid=831049
https://go.microsoft.com/fwlink/p/?linkid=831049 - FixedMicrosoft Outlook for iOSmsrc_csaf
5.2605:Security Update:https://apps.apple.com/ca/app/microsoft-outlook/id951937596
https://apps.apple.com/ca/app/microsoft-outlook/id951937596 - FixedMicrosoft PowerBI for Androidmsrc_csaf
2.2.260210.21290750:Security Update:https://play.google.com/store/search?q=powerbi&c=apps
https://play.google.com/store/search?q=powerbi&c=apps - FixedMicrosoft PowerBI for iOSmsrc_csaf
1.2.260302.2193910:Security Update:https://apps.apple.com/us/app/microsoft-power-bi/id929738808
https://apps.apple.com/us/app/microsoft-power-bi/id929738808 - FixedMicrosoft PowerPoint for Androidmsrc_csaf
16.0.19822.20038:Security Update:https://play.google.com/store/apps/details?id=com.microsoft.office.powerpoint&hl=en_US
https://play.google.com/store/apps/details?id=com.microsoft.office.powerpoint&hl=en_US - FixedMicrosoft PowerPoint for iOSmsrc_csaf
2.106.26020617:Security Update:https://apps.apple.com/us/app/microsoft-powerpoint/id586449534?platform=mac
https://apps.apple.com/us/app/microsoft-powerpoint/id586449534?platform=mac - FixedMicrosoft Teams for Androidmsrc_csaf
1.0.0.2026043102:Security Update:https://play.google.com/store/apps/details?id=com.microsoft.teams
https://play.google.com/store/apps/details?id=com.microsoft.teams - FixedMicrosoft Teams for iOSmsrc_csaf
8.3.1:Security Update:https://apps.apple.com/us/app/microsoft-teams/id1113153706
https://apps.apple.com/us/app/microsoft-teams/id1113153706 - FixedMicrosoft Word for Androidmsrc_csaf
16.0.19822.20038:Security Update:https://play.google.com/store/apps/details?id=com.microsoft.office.word&hl=en_US
https://play.google.com/store/apps/details?id=com.microsoft.office.word&hl=en_US - FixedMicrosoft Word for iOSmsrc_csaf
2.106.26020617:Security Update:https://apps.apple.com/us/app/microsoft-word/id462054704?mt=12
https://apps.apple.com/us/app/microsoft-word/id462054704?mt=12
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.5–7.1
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (80)
Products and version ranges known to be affected.
- Microsoft 365 Copilot 365 Copilot's Business Chatall versionscert_bundDEcpe:/a:microsoft:365_copilot:-
- Microsoft Edge Android and iOS 145.3800.99all versionscert_bundDEcpe:/a:microsoft:edge:android_and_ios_145.3800.99
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-0717Microsoft 365 Copilot und Edge: Schwachstelle ermöglicht Offenlegung von Informationen und Manipulation von DatenDeutsch2026-03-12csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Microsoft 365 Copilot und Microsoft Edge ausnutzen, um sensible Informationen offenzulegen oder begrenzte Änderungen vorzunehmen.
- msrc_CVE-2026-26133M365 Copilot Information Disclosure Vulnerability2026-03-12csaf · msrc_csafUS
To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle
also known as (2)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (3)
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan