CVE-2026-26133

Summary

AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Affected Software

VendorProductVersion RangeStatus
MicrosoftMicrosoft 365 Copilot for Android1.0 < 16.0.19815.10000affected
MicrosoftMicrosoft 365 Copilot for iOS1.0 < 2.107.2affected
MicrosoftMicrosoft Edge for Android1.0.0 < 145.3800.99affected
MicrosoftMicrosoft Edge for iOS1.0.0.0 < 145.3800.99affected
MicrosoftMicrosoft Excel for Android16.0.0.0 < 16.0.19822.20038affected
MicrosoftMicrosoft Excel for iOS1.0 < 2.106.26020617affected
MicrosoftMicrosoft Loop for iOS2.0.0 < 2.106.26020617affected
MicrosoftMicrosoft OneNote1.0.0 < 2.106.26020617affected
MicrosoftMicrosoft OneNote for Android16.0.1 < 16.0.19725.20142affected
MicrosoftMicrosoft Outlook for Android1.0 < 5.2605affected
MicrosoftMicrosoft Outlook for iOS1.0.0 < 5.2605affected
MicrosoftMicrosoft Outlook for Mac1.0.0 < 5.2605affected
MicrosoftMicrosoft PowerBI for Android2.0.0 < 2.2.260210.21290750affected
MicrosoftMicrosoft PowerBI for iOS1.0.0 < 1.2.260302.2193910affected
MicrosoftMicrosoft PowerPoint for Android16.0.0.0 < 16.0.19822.20038affected
MicrosoftMicrosoft PowerPoint for iOS1.0 < 2.106.26020617affected
MicrosoftMicrosoft Teams for Android1.0.0 < 1.0.0.2026043102affected
MicrosoftMicrosoft Teams for iOS2.0.0 < 8.3.1affected
MicrosoftMicrosoft Word for Android16.0.0.0 < 16.0.19822.20038affected
MicrosoftMicrosoft Word for iOS2.0.0 < 2.106.26020617affected

Weaknesses

  • CWE-77: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References