Vulnerability · NVD

CVE-2026-26133

CVE-2026-26133, high severity (CVSS 7.1): 14 tracked apps concerned, all fixed or indeterminable on their current version.

Severity (CVSS): 7.1
Exploitation: 0.5 %
Tracked apps: 14
Still exposed: 0

Published on 2026-03-16

AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Attack vector : Network No privileges required

Show raw CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

EPSS 0.54% exploit very unlikely percentile 43.1%

Tracked apps referencing this CVE

For each app: the affected range, the fixing version, and where the tracked app stands today.

Microsoft Edge iOS com.microsoft.msedge

Affected <145.3800.99 Fixed in 145.3800.99 Latest tracked 153.4234.46 patched

Observed affected builds (15)

145.3800.92 145.3800.85 144.3719.115 144.3719.103 144.3719.99 144.3719.91 144.3719.81 143.3650.139 143.3650.130 143.3650.112 143.3650.97 143.3650.82 143.3650.77 143.3650.72 142.3595.107
Microsoft Excel iOS com.microsoft.Office.Excel

Affected <2.106.2 Fixed in 2.106.2 Latest tracked 2.114.1 patched

Observed affected builds (13)

2.106.1 2.106 2.105.4 2.105.3 2.105.2 2.105.1 2.105 2.104.2 2.104.1 2.104 2.103.4 2.103.3 2.103.2
Microsoft Excel Android com.microsoft.office.excel

Affected <16.0.19822.20038 Fixed in 16.0.19822.20038 Latest tracked 16.0.20430.20032 patched

Observed affected builds (20)

16.0.19725.20108 16.0.19725.20058 16.0.19127.20134 16.0.18925.20074 16.0.17726.20080 16.0.17328.20152 16.0.17231.20130 16.0.16924.20064 16.0.13801.20162 16.0.13628.20214 16.0.13530.20130 16.0.13231.20130 16.0.13029.20182 16.0.12430.20120 16.0.11929.20222 16.0.11901.20110 16.0.11126.20063 16.0.11029.20056 16.0.10827.20078 16.0.10730.20043
Microsoft Loop iOS ios:com.microsoft.loop

Affected <2.106 Fixed in 2.106 Latest tracked 2.114.1 patched
Microsoft OneNote iOS com.microsoft.onenote

Affected - Fixed in - Latest tracked 16.114.1 undetermined
Microsoft OneNote Android com.microsoft.office.onenote

Affected <16.0.19725.20142 Fixed in 16.0.19725.20142 Latest tracked 16.0.20326.20108 patched

Observed affected builds (15)

16.0.19426.20256 16.0.19127.20320 16.0.19127.20224 16.0.18925.20004 16.0.18730.20110 16.0.18429.20096 16.0.18324.20190 16.0.18025.20060 16.0.17928.20098 16.0.17726.20082 16.0.16026.20158 16.0.14326.20180 16.0.12827.20234 16.0.11727.20002 16.0.11425.20118
Microsoft Outlook Android com.microsoft.office.outlook

Affected <5.2605.0 Fixed in 5.2605.0 Latest tracked 5.2637.3 patched

Observed affected builds (6)

5.2604.1 5.2547.0 4.2539.1 4.2538.2 4.2447.2 4.2442.1
Microsoft Outlook iOS com.microsoft.Office.Outlook

Affected <5.2605.0 Fixed in 5.2605.0 Latest tracked 5.2637.1 patched

Observed affected builds (7)

5.2604.0 5.2603.0 5.2602.2 5.2602.1 5.2602.0 5.2601.0 5.2552.1
Microsoft Outlook macOS com.microsoft.Outlook

Affected - Fixed in - Latest tracked 16.113.26091740 undetermined
Microsoft PowerPoint Android com.microsoft.office.powerpoint

Affected <16.0.19822.20038 Fixed in 16.0.19822.20038 Latest tracked 16.0.20326.20112 patched

Observed affected builds (11)

16.0.19725.20126 16.0.19530.20070 16.0.19426.20104 16.0.19127.20046 16.0.19029.20080 16.0.16327.20262 16.0.13929.20196 16.0.13001.20166 16.0.11929.20198 16.0.11126.20063 16.0.11029.20056
Microsoft PowerPoint iOS com.microsoft.Office.Powerpoint

Affected <2.106.2 Fixed in 2.106.2 Latest tracked 2.114.1 patched

Observed affected builds (13)

2.106.1 2.106 2.105.4 2.105.3 2.105.2 2.105.1 2.105 2.104.2 2.104.1 2.104 2.103.4 2.103.3 2.103.2
Microsoft Teams iOS com.microsoft.skype.teams

Affected <8.3.1 Fixed in 8.3.1 Latest tracked 8.17.0 patched

Observed affected builds (15)

8.3.0 8.2.2 8.2.1 8.2.0 8.1.1 8.1.0 7.23.2 7.23.1 7.23.0 7.22.2 7.22.1 7.22.0 7.21.1 7.21.0 7.20.1
Microsoft Word iOS com.microsoft.Office.Word

Affected <2.106.2 Fixed in 2.106.2 Latest tracked 2.114.1 patched

Observed affected builds (13)

2.106.1 2.106 2.105.4 2.105.2 2.105.1 2.105 2.104.2 2.104.1 2.104 2.103.4 2.103.3 2.103.2 2.103.1
Microsoft Word Android com.microsoft.office.word

Affected <16.0.19822.20038 Fixed in 16.0.19822.20038 Latest tracked 16.0.20430.20032 patched

Observed affected builds (27)

16.0.19725.20058 16.0.19628.20074 16.0.19530.20070 16.0.19328.20086 16.0.19231.20090 16.0.19127.20134 16.0.19029.20110 16.0.18526.20030 16.0.18429.20094 16.0.18324.20086 16.0.17830.20082 16.0.17328.20152 16.0.16501.20160 16.0.15629.20092 16.0.15427.20090 16.0.15128.20206 16.0.14729.20146 16.0.14527.20162 16.0.14326.20140 16.0.14228.20138 16.0.13801.20162 16.0.13127.20162 16.0.13029.20182 16.0.12624.20254 16.0.12130.20208 16.0.11001.20074 16.0.10827.20078

Vulnerable CPE configurations (20)

Vendor	Product	Platform	Versions	CPE 2.3 URI
microsoft	365_copilot iOS	iOS	<2.107.2	cpe:2.3:a:microsoft:365_copilot::::::iphone_os::*
microsoft	365_copilot Android	Android	<16.0.19815.10000	cpe:2.3:a:microsoft:365_copilot::::::android::*
microsoft	edge Android	Android	<145.3800.99	cpe:2.3:a:microsoft:edge::::::android::*
microsoft	edge iOS	iOS	<145.3800.99	cpe:2.3:a:microsoft:edge::::::iphone_os::*
microsoft	excel iOS	iOS	<2.106.2	cpe:2.3:a:microsoft:excel::::::iphone_os::*
microsoft	excel Android	Android	<16.0.19822.20038	cpe:2.3:a:microsoft:excel::::::android::*
microsoft	loop iOS	iOS	<2.106	cpe:2.3:a:microsoft:loop::::::iphone_os::*
microsoft	onenote Android	Android	<16.0.19725.20142	cpe:2.3:a:microsoft:onenote::::::android::*
microsoft	onenote iOS	iOS	-	cpe:2.3:a:microsoft:onenote:-:::::iphone_os::
microsoft	outlook Android	Android	<5.2605.0	cpe:2.3:a:microsoft:outlook::::::android::*
microsoft	outlook iOS	iOS	<5.2605.0	cpe:2.3:a:microsoft:outlook::::::iphone_os::*
microsoft	outlook macOS	macOS	-	cpe:2.3:a:microsoft:outlook:-:::::macos::
microsoft	power_bi Android	Android	<2.2.260210.21290750	cpe:2.3:a:microsoft:power_bi::::::android::*
microsoft	power_bi iOS	iOS	-	cpe:2.3:a:microsoft:power_bi:-:::::iphone_os::
microsoft	powerpoint iOS	iOS	<2.106.2	cpe:2.3:a:microsoft:powerpoint::::::iphone_os::*
microsoft	powerpoint Android	Android	<16.0.19822.20038	cpe:2.3:a:microsoft:powerpoint::::::android::*
microsoft	teams Android	Android	<1.0.0.2026043102	cpe:2.3:a:microsoft:teams::::::android::*
microsoft	teams iOS	iOS	<8.3.1	cpe:2.3:a:microsoft:teams::::::iphone_os::*
microsoft	word iOS	iOS	<2.106.2	cpe:2.3:a:microsoft:word::::::iphone_os::*
microsoft	word Android	Android	<16.0.19822.20038	cpe:2.3:a:microsoft:word::::::android::*

View on NVD ↗ Advisory · msrc.microsoft.com

Manage your fleet with Appaloosa

Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.

Discover Appaloosa MDM