PT-2026-24950 · Microsoft · M365 Copilot+28

Andi Ahmeti

·

Published

2026-03-12

·

Updated

2026-05-09

·

CVE-2026-26133

CVSS v3.1

7.1

High

VectorAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Name of the Vulnerable Software and Affected Versions Microsoft 365 Copilot (affected versions not specified)
Description An AI command injection issue exists in Microsoft 365 Copilot, potentially allowing an unauthorized attacker to disclose information over a network. This issue is related to cross-prompt injection attacks, where hidden instructions within files or email content can manipulate AI-generated summaries and prompts. The vulnerability could enable AI-assisted phishing attacks, allowing attacker-controlled content to influence trusted AI summaries and lead users to take malicious actions. The vulnerability affects enterprise and Microsoft 365 users.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-26133

Affected Products

M365 Copilot
365 Copilot For Android
365 Copilot For Ios
Edge For Android
Edge For Ios
Excel For Android
Excel For Ios
Loop For Ios
Office Onenote
Onenote For Android
Outlook For Android
Outlook For Mac
Outlook For Ios
Powerbi For Android
Powerbi For Ios
Powerpoint For Android
Powerpoint For Ios
Teams For Android
Teams For Ios
Word For Android
Word For Ios
Edge
Office Excel
Loop
Outlook
Power Bi
Office Powerpoint
Teams
Office Word