9.3
Critical
CVE-2026-41090 Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an…
Description
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft 365 Copilot for iOS | Versions not published |
References
- Microsoft Copilot Tampering Vulnerability msrc.microsoft.com
Timeline
- Published
- Last modified
Other CVEs of Microsoft 365 Copilot for iOS
The 4 CVEs of Microsoft 365 Copilot for iOS →
CVE-2026-58617
Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a…
8.1
High
CVE-2026-48561
Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge)…
9.6
Critical
CVE-2026-26133
AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network
7.1
High