CVE-2026-41090

No fix known EPSS <1%CVSS 9.3

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.

Published 2026-05-22 · CVE record · OSV

Products: Microsoft 365 Copilot for iOS