CVEvulnerability

CVE-2026-26133

7.1 HIGH Published 2026-03-16 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2026-03-16
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Weaknesses
CWE-77

Description

AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Affected configurations

• microsoft 365 copilot (< 2.107.2) • microsoft 365 copilot (< 16.0.19815.10000) • microsoft edge (< 145.3800.99) • microsoft excel (< 2.106.2) • microsoft excel (< 16.0.19822.20038) • microsoft loop (< 2.106) • microsoft onenote (< 16.0.19725.20142) • microsoft onenote • microsoft outlook (< 5.2605.0) • microsoft outlook • microsoft power bi (< 2.2.260210.21290750) • microsoft power bi • microsoft powerpoint (< 2.106.2) • microsoft powerpoint (< 16.0.19822.20038) • microsoft teams (< 1.0.0.2026043102) • microsoft teams (< 8.3.1) • microsoft word (< 2.106.2) • microsoft word (< 16.0.19822.20038)

Related

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References