CVE-2026-26133

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26133", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2026-02-11T16:24:51.133Z", "datePublished": "2026-03-13T21:10:13.535Z", "dateUpdated": "2026-06-19T18:18:11.619Z"}, "containers": {"cna": {"title": "M365 Copilot Information Disclosure Vulnerability", "datePublic": "2026-03-12T14:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:onenote_for_ios:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "2.106.26020617"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:outlook:*:*:*:*:*:macos:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "5.2605"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:outlook_2016:*:*:*:*:*:android:*:*", "versionStartIncluding": "1.0", "versionEndExcluding": "5.2605"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:365_copilot_iOS:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0", "versionEndExcluding": "2.107.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:edge:*:*:*:*:*:android:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "145.3800.99"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:teams:*:*:*:*:*:iphone_os:*:*", "versionStartIncluding": "2.0.0", "versionEndExcluding": "8.3.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:teams:*:*:*:*:*:android:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "1.0.0.2026043102"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:excel:*:*:*:*:*:android:*:*", "versionStartIncluding": "16.0.0.0", "versionEndExcluding": "16.0.19822.20038"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:word:*:*:*:*:*:android:*:*", "versionStartIncluding": "16.0.0.0", "versionEndExcluding": "16.0.19822.20038"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:powerpoint:*:*:iOS:*:*:*:*:*", "versionStartIncluding": "1.0", "versionEndExcluding": "2.106.26020617"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:word:*:*:iOS:*:*:*:*:*", "versionStartIncluding": "2.0.0", "versionEndExcluding": "2.106.26020617"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:loop:*:*:iOS:*:*:*:*:*", "versionStartIncluding": "2.0.0", "versionEndExcluding": "2.106.26020617"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:outlook:*:*:*:*:*:iphone_os:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "5.2605"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:365_copilot_Android:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0", "versionEndExcluding": "16.0.19815.10000"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:power_bi_android:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.0.0", "versionEndExcluding": "2.2.260210.21290750"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:power_bi_iOS:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "1.2.260302.2193910"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:onenote_for_android:*:*:*:*:*:*:*:*", "versionStartIncluding": "16.0.1", "versionEndExcluding": "16.0.19725.20142"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:edge:*:*:*:*:*:iphone_os:*:*", "versionStartIncluding": "1.0.0.0", "versionEndExcluding": "145.3800.99"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:powerpoint:*:*:*:*:*:android:*:*", "versionStartIncluding": "16.0.0.0", "versionEndExcluding": "16.0.19822.20038"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:excel:*:*:iOS:*:*:*:*:*", "versionStartIncluding": "1.0", "versionEndExcluding": "2.106.26020617"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft 365 Copilot for Android", "versions": [{"version": "1.0", "lessThan": "16.0.19815.10000", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft 365 Copilot for iOS", "versions": [{"version": "1.0", "lessThan": "2.107.2", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Edge for Android", "versions": [{"version": "1.0.0", "lessThan": "145.3800.99", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Edge for iOS", "versions": [{"version": "1.0.0.0", "lessThan": "145.3800.99", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Excel for Android", "versions": [{"version": "16.0.0.0", "lessThan": "16.0.19822.20038", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Excel for iOS", "versions": [{"version": "1.0", "lessThan": "2.106.26020617", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Loop for iOS", "versions": [{"version": "2.0.0", "lessThan": "2.106.26020617", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft OneNote", "versions": [{"version": "1.0.0", "lessThan": "2.106.26020617", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft OneNote for Android", "versions": [{"version": "16.0.1", "lessThan": "16.0.19725.20142", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Outlook for Android", "versions": [{"version": "1.0", "lessThan": "5.2605", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Outlook for iOS", "versions": [{"version": "1.0.0", "lessThan": "5.2605", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Outlook for Mac", "versions": [{"version": "1.0.0", "lessThan": "5.2605", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft PowerBI for Android", "versions": [{"version": "2.0.0", "lessThan": "2.2.260210.21290750", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft PowerBI for iOS", "versions": [{"version": "1.0.0", "lessThan": "1.2.260302.2193910", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft PowerPoint for Android", "versions": [{"version": "16.0.0.0", "lessThan": "16.0.19822.20038", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft PowerPoint for iOS", "versions": [{"version": "1.0", "lessThan": "2.106.26020617", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Teams for Android", "versions": [{"version": "1.0.0", "lessThan": "1.0.0.2026043102", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Teams for iOS", "versions": [{"version": "2.0.0", "lessThan": "8.3.1", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Word for Android", "versions": [{"version": "16.0.0.0", "lessThan": "16.0.19822.20038", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Word for iOS", "versions": [{"version": "2.0.0", "lessThan": "2.106.26020617", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')", "lang": "en-US", "type": "CWE", "cweId": "CWE-77"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-06-19T18:18:11.619Z"}, "references": [{"name": "M365 Copilot Information Disclosure Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26133"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-16T14:24:19.473896Z", "id": "CVE-2026-26133", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T14:24:30.194Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26133", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-16T14:24:19.473896Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T14:24:27.333Z"}}], "cna": {"title": "M365 Copilot Information Disclosure Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft 365 Copilot for Android", "versions": [{"status": "affected", "version": "1.0", "lessThan": "16.0.19815.10000", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft 365 Copilot for iOS", "versions": [{"status": "affected", "version": "1.0", "lessThan": "2.107.2", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft Edge for Android", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "145.3800.99", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft Edge for iOS", "versions": [{"status": "affected", "version": "1.0.0.0", "lessThan": "145.3800.99", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft Excel for Android", "versions": [{"status": "affected", "version": "16.0.0.0", "lessThan": "16.0.19822.20038", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft Excel for iOS", "versions": [{"status": "affected", "version": "1.0", "lessThan": "2.106.26020617", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft Loop for iOS", "versions": [{"status": "affected", "version": "2.0.0", "lessThan": "2.106.26020617", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft OneNote", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "2.106.26020617", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft OneNote for Android", "versions": [{"status": "affected", "version": "16.0.1", "lessThan": "16.0.19725.20142", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft Outlook for Android", "versions": [{"status": "affected", "version": "1.0", "lessThan": "5.2605", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft Outlook for iOS", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "5.2605", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft Outlook for Mac", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "5.2605", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft PowerBI for Android", "versions": [{"status": "affected", "version": "2.0.0", "lessThan": "2.2.260210.21290750", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft PowerBI for iOS", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.2.260302.2193910", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft PowerPoint for Android", "versions": [{"status": "affected", "version": "16.0.0.0", "lessThan": "16.0.19822.20038", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft PowerPoint for iOS", "versions": [{"status": "affected", "version": "1.0", "lessThan": "2.106.26020617", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft Teams for Android", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.0.0.2026043102", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft Teams for iOS", "versions": [{"status": "affected", "version": "2.0.0", "lessThan": "8.3.1", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft Word for Android", "versions": [{"status": "affected", "version": "16.0.0.0", "lessThan": "16.0.19822.20038", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft Word for iOS", "versions": [{"status": "affected", "version": "2.0.0", "lessThan": "2.106.26020617", "versionType": "custom"}]}], "datePublic": "2026-03-12T14:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26133", "name": "M365 Copilot Information Disclosure Vulnerability", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en-US", "value": "AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:onenote_for_ios:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.106.26020617", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:microsoft:outlook:*:*:*:*:*:macos:*:*", "vulnerable": true, "versionEndExcluding": "5.2605", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:microsoft:outlook_2016:*:*:*:*:*:android:*:*", "vulnerable": true, "versionEndExcluding": "5.2605", "versionStartIncluding": "1.0"}, {"criteria": "cpe:2.3:a:microsoft:365_copilot_iOS:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.107.2", "versionStartIncluding": "1.0"}, {"criteria": "cpe:2.3:a:microsoft:edge:*:*:*:*:*:android:*:*", "vulnerable": true, "versionEndExcluding": "145.3800.99", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:microsoft:teams:*:*:*:*:*:iphone_os:*:*", "vulnerable": true, "versionEndExcluding": "8.3.1", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:microsoft:teams:*:*:*:*:*:android:*:*", "vulnerable": true, "versionEndExcluding": "1.0.0.2026043102", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:microsoft:excel:*:*:*:*:*:android:*:*", "vulnerable": true, "versionEndExcluding": "16.0.19822.20038", "versionStartIncluding": "16.0.0.0"}, {"criteria": "cpe:2.3:a:microsoft:word:*:*:*:*:*:android:*:*", "vulnerable": true, "versionEndExcluding": "16.0.19822.20038", "versionStartIncluding": "16.0.0.0"}, {"criteria": "cpe:2.3:a:microsoft:powerpoint:*:*:iOS:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.106.26020617", "versionStartIncluding": "1.0"}, {"criteria": "cpe:2.3:a:microsoft:word:*:*:iOS:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.106.26020617", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:microsoft:loop:*:*:iOS:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.106.26020617", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:microsoft:outlook:*:*:*:*:*:iphone_os:*:*", "vulnerable": true, "versionEndExcluding": "5.2605", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:microsoft:365_copilot_Android:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "16.0.19815.10000", "versionStartIncluding": "1.0"}, {"criteria": "cpe:2.3:a:microsoft:power_bi_android:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.2.260210.21290750", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:microsoft:power_bi_iOS:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.2.260302.2193910", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:microsoft:onenote_for_android:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "16.0.19725.20142", "versionStartIncluding": "16.0.1"}, {"criteria": "cpe:2.3:a:microsoft:edge:*:*:*:*:*:iphone_os:*:*", "vulnerable": true, "versionEndExcluding": "145.3800.99", "versionStartIncluding": "1.0.0.0"}, {"criteria": "cpe:2.3:a:microsoft:powerpoint:*:*:*:*:*:android:*:*", "vulnerable": true, "versionEndExcluding": "16.0.19822.20038", "versionStartIncluding": "16.0.0.0"}, {"criteria": "cpe:2.3:a:microsoft:excel:*:*:iOS:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.106.26020617", "versionStartIncluding": "1.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-06-19T18:18:11.619Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26133", "state": "PUBLISHED", "dateUpdated": "2026-06-19T18:18:11.619Z", "dateReserved": "2026-02-11T16:24:51.133Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2026-03-13T21:10:13.535Z", "assignerShortName": "microsoft"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Microsoft 365 Copilot for Android", "vendor": "Microsoft", "versions": [{"lessThan": "16.0.19815.10000", "status": "affected", "version": "1.0", "versionType": "custom"}]}, {"product": "Microsoft 365 Copilot for iOS", "vendor": "Microsoft", "versions": [{"lessThan": "2.107.2", "status": "affected", "version": "1.0", "versionType": "custom"}]}, {"product": "Microsoft Edge for Android", "vendor": "Microsoft", "versions": [{"lessThan": "145.3800.99", "status": "affected", "version": "1.0.0", "versionType": "custom"}]}, {"product": "Microsoft Edge for iOS", "vendor": "Microsoft", "versions": [{"lessThan": "145.3800.99", "status": "affected", "version": "1.0.0.0", "versionType": "custom"}]}, {"product": "Microsoft Excel for Android", "vendor": "Microsoft", "versions": [{"lessThan": "16.0.19822.20038", "status": "affected", "version": "16.0.0.0", "versionType": "custom"}]}, {"product": "Microsoft Excel for iOS", "vendor": "Microsoft", "versions": [{"lessThan": "2.106.26020617", "status": "affected", "version": "1.0", "versionType": "custom"}]}, {"product": "Microsoft Loop for iOS", "vendor": "Microsoft", "versions": [{"lessThan": "2.106.26020617", "status": "affected", "version": "2.0.0", "versionType": "custom"}]}, {"product": "Microsoft OneNote", "vendor": "Microsoft", "versions": [{"lessThan": "2.106.26020617", "status": "affected", "version": "1.0.0", "versionType": "custom"}]}, {"product": "Microsoft OneNote for Android", "vendor": "Microsoft", "versions": [{"lessThan": "16.0.19725.20142", "status": "affected", "version": "16.0.1", "versionType": "custom"}]}, {"product": "Microsoft Outlook for Android", "vendor": "Microsoft", "versions": [{"lessThan": "5.2605", "status": "affected", "version": "1.0", "versionType": "custom"}]}, {"product": "Microsoft Outlook for iOS", "vendor": "Microsoft", "versions": [{"lessThan": "5.2605", "status": "affected", "version": "1.0.0", "versionType": "custom"}]}, {"product": "Microsoft Outlook for Mac", "vendor": "Microsoft", "versions": [{"lessThan": "5.2605", "status": "affected", "version": "1.0.0", "versionType": "custom"}]}, {"product": "Microsoft PowerBI for Android", "vendor": "Microsoft", "versions": [{"lessThan": "2.2.260210.21290750", "status": "affected", "version": "2.0.0", "versionType": "custom"}]}, {"product": "Microsoft PowerBI for iOS", "vendor": "Microsoft", "versions": [{"lessThan": "1.2.260302.2193910", "status": "affected", "version": "1.0.0", "versionType": "custom"}]}, {"product": "Microsoft PowerPoint for Android", "vendor": "Microsoft", "versions": [{"lessThan": "16.0.19822.20038", "status": "affected", "version": "16.0.0.0", "versionType": "custom"}]}, {"product": "Microsoft PowerPoint for iOS", "vendor": "Microsoft", "versions": [{"lessThan": "2.106.26020617", "status": "affected", "version": "1.0", "versionType": "custom"}]}, {"product": "Microsoft Teams for Android", "vendor": "Microsoft", "versions": [{"lessThan": "1.0.0.2026043102", "status": "affected", "version": "1.0.0", "versionType": "custom"}]}, {"product": "Microsoft Teams for iOS", "vendor": "Microsoft", "versions": [{"lessThan": "8.3.1", "status": "affected", "version": "2.0.0", "versionType": "custom"}]}, {"product": "Microsoft Word for Android", "vendor": "Microsoft", "versions": [{"lessThan": "16.0.19822.20038", "status": "affected", "version": "16.0.0.0", "versionType": "custom"}]}, {"product": "Microsoft Word for iOS", "vendor": "Microsoft", "versions": [{"lessThan": "2.106.26020617", "status": "affected", "version": "2.0.0", "versionType": "custom"}]}], "source": "secure@microsoft.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:365_copilot:*:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "236E57A2-4772-4C84-9AA5-E623FC2F547E", "versionEndExcluding": "2.107.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:365_copilot:*:*:*:*:*:android:*:*", "matchCriteriaId": "7AEBF186-6FE1-4808-B812-A55DFFB629B3", "versionEndExcluding": "16.0.19815.10000", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:edge:*:*:*:*:*:android:*:*", "matchCriteriaId": "096B9A15-8DA4-4DC2-A2D7-70FB7D50A578", "versionEndExcluding": "145.3800.99", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:edge:*:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "70EE133F-A117-4F41-85E7-E3E29E6598F3", "versionEndExcluding": "145.3800.99", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:excel:*:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "D3D0FC9C-4FF7-48D2-B6B5-C0F631B1A07F", "versionEndExcluding": "2.106.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:excel:*:*:*:*:*:android:*:*", "matchCriteriaId": "6C12366E-9991-4265-9939-904BFE430989", "versionEndExcluding": "16.0.19822.20038", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:loop:*:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "1766DBAA-0153-438F-BD60-73381334AB11", "versionEndExcluding": "2.106", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:onenote:*:*:*:*:*:android:*:*", "matchCriteriaId": "67CB78F7-2EBE-4657-8AB8-33F7CA0D1A58", "versionEndExcluding": "16.0.19725.20142", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:onenote:-:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "C473D8B1-69DA-4252-9A99-603CE3344D1D", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:outlook:*:*:*:*:*:android:*:*", "matchCriteriaId": "2FBAA043-3D54-4970-A074-717A31C54D63", "versionEndExcluding": "5.2605.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:outlook:*:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "6401B00C-BB0F-434F-B777-5A2ED4E55CF6", "versionEndExcluding": "5.2605.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:outlook:-:*:*:*:*:macos:*:*", "matchCriteriaId": "287DF1D6-0949-4AB3-8AB3-625CE745218A", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:power_bi:*:*:*:*:*:android:*:*", "matchCriteriaId": "5E95BF2F-3ED5-47EA-AFF2-739E19E3F185", "versionEndExcluding": "2.2.260210.21290750", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:power_bi:-:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "231BEECA-EECC-4F9F-A274-155F88C0DB13", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:powerpoint:*:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "92DE0FB6-FD20-4838-9110-1639534C85D5", "versionEndExcluding": "2.106.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:powerpoint:*:*:*:*:*:android:*:*", "matchCriteriaId": "432B5138-77FA-4282-944C-822842E55852", "versionEndExcluding": "16.0.19822.20038", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:teams:*:*:*:*:*:android:*:*", "matchCriteriaId": "723599DE-2621-4A05-840B-97394B6B0895", "versionEndExcluding": "1.0.0.2026043102", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:teams:*:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "E90345E3-4412-46BE-9F5F-10C679F5B5FB", "versionEndExcluding": "8.3.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:word:*:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "E3303015-2B25-4344-9F27-9257707AEA1F", "versionEndExcluding": "2.106.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:word:*:*:*:*:*:android:*:*", "matchCriteriaId": "90BE21AE-F476-4520-A9BA-7ECF36CC977D", "versionEndExcluding": "16.0.19822.20038", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network."}, {"lang": "es", "value": "La inyecci\u00f3n de comandos de IA en M365 Copilot permite a un atacante no autorizado divulgar informaci\u00f3n a trav\u00e9s de una red."}], "id": "CVE-2026-26133", "lastModified": "2026-06-17T10:25:47.033", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "secure@microsoft.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26133", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-16T14:24:19.473896Z", "version": "2.0.3"}}]}, "published": "2026-03-16T14:18:26.337", "references": [{"source": "secure@microsoft.com", "tags": ["Vendor Advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26133"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "secure@microsoft.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-77"}], "source": "nvd@nist.gov", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.0,16.0.19815.10000)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "365_copilot_for_android", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.0,2.107.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "365_copilot_for_ios", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0,145.3800.99)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "edge_for_android", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.0.0.0,145.3800.99)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "edge_for_ios", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[16.0.0.0,16.0.19822.20038)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "excel_for_android", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.0,2.106.26020617)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "excel_for_ios", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.0.0,2.106.26020617)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "loop_for_ios", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.0,2.106.26020617)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "onenote", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[16.0.1,16.0.19725.20142)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "onenote_for_android", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.0,5.2605)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "outlook_for_android", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.0.0,5.2605)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "outlook_for_ios", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.0.0,5.2605)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "outlook_for_mac", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.0.0,2.2.260210.21290750)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "powerbi_for_android", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.0.0,1.2.260302.2193910)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "powerbi_for_ios", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[16.0.0.0,16.0.19822.20038)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "powerpoint_for_android", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.0,2.106.26020617)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "powerpoint_for_ios", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.0.0,1.0.0.2026043102)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "teams_for_android", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,8.3.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "teams_for_ios", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[16.0.0.0,16.0.19822.20038)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "word_for_android", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.0.0,2.106.26020617)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "word_for_ios", "vendor": "microsoft"}], "analysis": {"en": {"generated_at": "2026-04-08T23:17:30.579036+00:00", "value": {"mitigation_remediation": ["Apply the latest updates for Microsoft 365 Copilot and all affected Office and Edge applications using the Microsoft Update Guide link provided.", "Ensure all Android and iOS installations of the affected applications are up\u2011to\u2011date.", "If updates are not yet available, restrict network access to the Copilot AI service or block outbound traffic to Microsoft Copilot endpoints until a patch is released.", "Monitor Microsoft security advisories and the CISA catalog for any new information on exploitation or additional workarounds."], "summary": {"action": "Patch Immediately", "impact": "Information Disclosure via Command Injection"}, "threat_synthesis": {"affected_systems": "The flaw is present in Microsoft 365 Copilot on Android and iOS, as well as in several Microsoft applications that include the Copilot feature on those platforms. These applications are Microsoft Edge, Microsoft Excel, Microsoft PowerPoint, Microsoft Word, Microsoft OneNote, Microsoft Outlook, Microsoft PowerBI, Microsoft Teams, and Microsoft Loop. The exact product versions that may be affected are not listed in the public advisory, so any current releases of the above apps on Android and iOS could be vulnerable until a patch is released.", "description_and_impact": "An AI command injection flaw in Microsoft 365 Copilot allows an unauthorized attacker to disclose sensitive information over a network by injecting arbitrary commands into the Copilot processing pipeline. The vulnerability stems from improper sanitization of user input in the Copilot interface, enabling attackers to retrieve data without authentication. This type of weakness directly maps to CWE\u201177 (Command Injection).", "risk_and_exploitability": "The CVSS base score of 7.1 signals a moderate\u2011to\u2011high severity. The EPSS metric is below 1\u202f%, indicating that real\u2011world exploitation is currently uncommon. The vulnerability is not included in the CISA Known Exploited Vulnerabilities catalog. Attackers would most likely target the Copilot AI input interface over a network connection, sending crafted payloads to trigger command injection; this inference is based on the advisory\u2019s description, as the official documentation does not specify a precise attack vector."}}}}, "created": "2026-03-16T09:22:50.573969+00:00", "updated": "2026-04-09T08:29:49.957279+00:00", "vendors": ["microsoft", "microsoft$PRODUCT$365_copilot_for_android", "microsoft$PRODUCT$365_copilot_for_ios", "microsoft$PRODUCT$edge_for_android", "microsoft$PRODUCT$edge_for_ios", "microsoft$PRODUCT$excel_for_android", "microsoft$PRODUCT$excel_for_ios", "microsoft$PRODUCT$loop_for_ios", "microsoft$PRODUCT$onenote", "microsoft$PRODUCT$onenote_for_android", "microsoft$PRODUCT$outlook_for_android", "microsoft$PRODUCT$outlook_for_ios", "microsoft$PRODUCT$outlook_for_mac", "microsoft$PRODUCT$powerbi_for_android", "microsoft$PRODUCT$powerbi_for_ios", "microsoft$PRODUCT$powerpoint_for_android", "microsoft$PRODUCT$powerpoint_for_ios", "microsoft$PRODUCT$teams_for_android", "microsoft$PRODUCT$teams_for_ios", "microsoft$PRODUCT$word_for_android", "microsoft$PRODUCT$word_for_ios"]}