7.1
High
CVE-2026-26133 AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network
Description
AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft 365 Copilot for Android 1.0 | 1.0 → < 16.0.19815.10000 | 16.0.19815.10000 |
| Microsoft 365 Copilot for iOS 1.0 | 1.0 → < 2.107.2 | 2.107.2 |
| Microsoft Edge for Android 1.0 | 1.0.0 → < 145.3800.99 | 145.3800.99 |
| Microsoft Edge for iOS 1.0 | 1.0.0.0 → < 145.3800.99 | 145.3800.99 |
| Microsoft Excel for Android 16.0 | 16.0.0.0 → < 16.0.19822.20038 | 16.0.19822.20038 |
| Microsoft Excel for iOS 1.0 | 1.0 → < 2.106.26020617 | 2.106.26020617 |
| Microsoft Loop for iOS 2.0 | 2.0.0 → < 2.106.26020617 | 2.106.26020617 |
| Microsoft OneNote 1.0 | 1.0.0 → < 2.106.26020617 | 2.106.26020617 |
| Microsoft OneNote for Android 16.0 | 16.0.1 → < 16.0.19725.20142 | 16.0.19725.20142 |
Show the 11 other branches Hide the 11 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft Outlook for Android 1.0 | 1.0 → < 5.2605 | 5.2605 |
| Microsoft Outlook for iOS 1.0 | 1.0.0 → < 5.2605 | 5.2605 |
| Microsoft Outlook for Mac 1.0 | 1.0.0 → < 5.2605 | 5.2605 |
| Microsoft PowerBI for Android 2.0 | 2.0.0 → < 2.2.260210.21290750 | 2.2.260210.21290750 |
| Microsoft PowerBI for iOS 1.0 | 1.0.0 → < 1.2.260302.2193910 | 1.2.260302.2193910 |
| Microsoft PowerPoint for Android 16.0 | 16.0.0.0 → < 16.0.19822.20038 | 16.0.19822.20038 |
| Microsoft PowerPoint for iOS 1.0 | 1.0 → < 2.106.26020617 | 2.106.26020617 |
| Microsoft Teams for Android 1.0 | 1.0.0 → < 1.0.0.2026043102 | 1.0.0.2026043102 |
| Microsoft Teams for iOS 2.0 | 2.0.0 → < 8.3.1 | 8.3.1 |
| Microsoft Word for Android 16.0 | 16.0.0.0 → < 16.0.19822.20038 | 16.0.19822.20038 |
| Microsoft Word for iOS 2.0 | 2.0.0 → < 2.106.26020617 | 2.106.26020617 |
References
- M365 Copilot Information Disclosure Vulnerability msrc.microsoft.com
Timeline
- Published
- Last modified