CVE-2026-26133

No fix known EPSS <1%CVSS 7.1

AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Published 2026-03-13 · CVE record · OSV

Products: Microsoft 365 Copilot for Android, Microsoft 365 Copilot for iOS, Microsoft Edge for Android, Microsoft Edge for iOS, Microsoft Excel for Android, Microsoft Excel for iOS, Microsoft Loop for iOS, Microsoft OneNote, Microsoft OneNote for Android, Microsoft Outlook for Android, Microsoft Outlook for iOS, Microsoft Outlook for Mac, Microsoft PowerBI for Android, Microsoft PowerBI for iOS, Microsoft PowerPoint for Android, Microsoft PowerPoint for iOS, Microsoft Teams for Android, Microsoft Teams for iOS, Microsoft Word for Android, Microsoft Word for iOS