Vulnerability · NVD

CVE-2026-26133

HIGH 7.1 Published on 2026-03-16

AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Attack vector : Network No privileges required

Show raw CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

EPSS 0.43% exploit very unlikely percentile 35.7%

Tracked apps referencing this CVE

For each app: the affected range, the fixing version, and where the tracked app stands today.

Microsoft Edge iOS com.microsoft.msedge

Affected <145.3800.99 Fixed in 145.3800.99 Latest tracked 151.4129.72 patched
Microsoft Excel iOS com.microsoft.Office.Excel

Affected <2.106.2 Fixed in 2.106.2 Latest tracked 2.112.4 patched
Microsoft Excel Android com.microsoft.office.excel

Affected <16.0.19822.20038 Fixed in 16.0.19822.20038 Latest tracked 16.0.20228.20042 patched
Microsoft Loop iOS ios:com.microsoft.loop

Affected <2.106 Fixed in 2.106 Latest tracked 2.111.5 patched
Microsoft OneNote iOS com.microsoft.onenote

Affected — Fixed in — Latest tracked 16.112.4 undetermined
Microsoft OneNote Android com.microsoft.office.onenote

Affected <16.0.19725.20142 Fixed in 16.0.19725.20142 Latest tracked 16.0.20131.20126 patched
Microsoft Outlook Android com.microsoft.office.outlook

Affected <5.2605.0 Fixed in 5.2605.0 Latest tracked 5.2630.0 patched
Microsoft Outlook iOS com.microsoft.Office.Outlook

Affected <5.2605.0 Fixed in 5.2605.0 Latest tracked 5.2630.0 patched
Microsoft PowerPoint iOS com.microsoft.Office.PowerPoint

Affected <2.106.2 Fixed in 2.106.2 Latest tracked 2.112.4 patched
Microsoft PowerPoint Android com.microsoft.office.powerpoint

Affected <16.0.19822.20038 Fixed in 16.0.19822.20038 Latest tracked 16.0.20228.20090 patched
Microsoft Teams iOS com.microsoft.skype.teams

Affected <8.3.1 Fixed in 8.3.1 Latest tracked 8.14 patched
Microsoft Word iOS com.microsoft.Office.Word

Affected <2.106.2 Fixed in 2.106.2 Latest tracked 2.112.3 patched
Microsoft Word Android com.microsoft.office.word

Affected <16.0.19822.20038 Fixed in 16.0.19822.20038 Latest tracked 16.0.19929.20052 patched

Vulnerable CPE configurations (19)

Vendor	Product	Platform	Versions	CPE 2.3 URI
microsoft	365_copilot iOS	iOS	<2.107.2	cpe:2.3:a:microsoft:365_copilot::::::iphone_os::*
microsoft	365_copilot Android	Android	<16.0.19815.10000	cpe:2.3:a:microsoft:365_copilot::::::android::*
microsoft	edge Android	Android	<145.3800.99	cpe:2.3:a:microsoft:edge::::::android::*
microsoft	edge iOS	iOS	<145.3800.99	cpe:2.3:a:microsoft:edge::::::iphone_os::*
microsoft	excel iOS	iOS	<2.106.2	cpe:2.3:a:microsoft:excel::::::iphone_os::*
microsoft	excel Android	Android	<16.0.19822.20038	cpe:2.3:a:microsoft:excel::::::android::*
microsoft	loop iOS	iOS	<2.106	cpe:2.3:a:microsoft:loop::::::iphone_os::*
microsoft	onenote Android	Android	<16.0.19725.20142	cpe:2.3:a:microsoft:onenote::::::android::*
microsoft	onenote iOS	iOS	—	cpe:2.3:a:microsoft:onenote:-:::::iphone_os::
microsoft	outlook Android	Android	<5.2605.0	cpe:2.3:a:microsoft:outlook::::::android::*
microsoft	outlook iOS	iOS	<5.2605.0	cpe:2.3:a:microsoft:outlook::::::iphone_os::*
microsoft	power_bi Android	Android	<2.2.260210.21290750	cpe:2.3:a:microsoft:power_bi::::::android::*
microsoft	power_bi iOS	iOS	—	cpe:2.3:a:microsoft:power_bi:-:::::iphone_os::
microsoft	powerpoint iOS	iOS	<2.106.2	cpe:2.3:a:microsoft:powerpoint::::::iphone_os::*
microsoft	powerpoint Android	Android	<16.0.19822.20038	cpe:2.3:a:microsoft:powerpoint::::::android::*
microsoft	teams Android	Android	<1.0.0.2026043102	cpe:2.3:a:microsoft:teams::::::android::*
microsoft	teams iOS	iOS	<8.3.1	cpe:2.3:a:microsoft:teams::::::iphone_os::*
microsoft	word iOS	iOS	<2.106.2	cpe:2.3:a:microsoft:word::::::iphone_os::*
microsoft	word Android	Android	<16.0.19822.20038	cpe:2.3:a:microsoft:word::::::android::*

View on NVD ↗ Advisory · msrc.microsoft.com