Log in Start free

Vulnerability · Published Mar 13, 2026 · Assigned by microsoft

CVE-2026-26133M365 Copilot Information Disclosure Vulnerability

High 7.1

In plain English

A high-severity command injection in Microsoft 365 Copilot for Android from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.4%top 60.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Affected products (as reported)

VendorProductVersions
Microsoft Microsoft 365 Copilot for Android 1.0 – before 16.0.19815.10000
Microsoft Microsoft 365 Copilot for iOS 1.0 – before 2.107.2
Microsoft Microsoft Edge for Android 1.0.0 – before 145.3800.99
Microsoft Microsoft Edge for iOS 1.0.0.0 – before 145.3800.99
Microsoft Microsoft Excel for Android 16.0.0.0 – before 16.0.19822.20038
Microsoft Microsoft Excel for iOS 1.0 – before 2.106.26020617
Microsoft Microsoft Loop for iOS 2.0.0 – before 2.106.26020617
Microsoft Microsoft OneNote 1.0.0 – before 2.106.26020617
Microsoft Microsoft OneNote for Android 16.0.1 – before 16.0.19725.20142
Microsoft Microsoft Outlook for Android 1.0 – before 5.2605
Microsoft Microsoft Outlook for iOS 1.0.0 – before 5.2605
Microsoft Microsoft Outlook for Mac 1.0.0 – before 5.2605
Microsoft Microsoft PowerBI for Android 2.0.0 – before 2.2.260210.21290750
Microsoft Microsoft PowerBI for iOS 1.0.0 – before 1.2.260302.2193910
Microsoft Microsoft PowerPoint for Android 16.0.0.0 – before 16.0.19822.20038
Microsoft Microsoft PowerPoint for iOS 1.0 – before 2.106.26020617
Microsoft Microsoft Teams for Android 1.0.0 – before 1.0.0.2026043102
Microsoft Microsoft Teams for iOS 2.0.0 – before 8.3.1
Microsoft Microsoft Word for Android 16.0.0.0 – before 16.0.19822.20038
Microsoft Microsoft Word for iOS 2.0.0 – before 2.106.26020617

Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N/E:U/RL:O/RC:C

References