CVE-2026-26133

Microsoft · Published March 12, 2026

7.1

CVSS v3.1

HIGH

Patch availableGet patch

Description

M365 Copilot Information Disclosure Vulnerability. AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Affected Products

Microsoft OneNote for iOS
Microsoft Outlook for Mac
Microsoft Outlook for Android
Microsoft 365 Copilot for iOS

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N/E:U/RL:O/RC:C