Read the docs
TI-2026-21126 Aliases CVE-2026-26133GHSA-rjf5-cxrf-4rvw

M365 Copilot Information Disclosure Vulnerability

Priority LOW 32CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from Microsoft.

Summary

AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0045 39th percentileScored 2026-11-07
Fix Fixed Microsoft 365 Copilot for Android (Microsoft): 16.0.19815.10000Microsoft 365 Copilot for iOS (Microsoft): 2.107.2+18 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft 365 Copilot for Android1.0 to before 16.0.19815.1000016.0.19815.10000Patch availableCNA
MicrosoftMicrosoft 365 Copilot for iOS1.0 to before 2.107.22.107.2Patch availableCNA
MicrosoftMicrosoft Edge for Android1.0.0 to before 145.3800.99145.3800.99Patch availableCNA
MicrosoftMicrosoft Edge for iOS1.0.0.0 to before 145.3800.99145.3800.99Patch availableCNA
MicrosoftMicrosoft Excel for Android16.0.0.0 to before 16.0.19822.2003816.0.19822.20038Patch availableCNA
MicrosoftMicrosoft Excel for iOS1.0 to before 2.106.260206172.106.26020617Patch availableCNA
MicrosoftMicrosoft Loop for iOS2.0.0 to before 2.106.260206172.106.26020617Patch availableCNA
MicrosoftMicrosoft OneNote1.0.0 to before 2.106.260206172.106.26020617Patch availableCNA
MicrosoftMicrosoft OneNote for Android16.0.1 to before 16.0.19725.2014216.0.19725.20142Patch availableCNA
MicrosoftMicrosoft Outlook for Android1.0 to before 5.26055.2605Patch availableCNA
MicrosoftMicrosoft Outlook for iOS1.0.0 to before 5.26055.2605Patch availableCNA
MicrosoftMicrosoft Outlook for Mac1.0.0 to before 5.26055.2605Patch availableCNA
MicrosoftMicrosoft PowerBI for Android2.0.0 to before 2.2.260210.212907502.2.260210.21290750Patch availableCNA
MicrosoftMicrosoft PowerBI for iOS1.0.0 to before 1.2.260302.21939101.2.260302.2193910Patch availableCNA
MicrosoftMicrosoft PowerPoint for Android16.0.0.0 to before 16.0.19822.2003816.0.19822.20038Patch availableCNA
MicrosoftMicrosoft PowerPoint for iOS1.0 to before 2.106.260206172.106.26020617Patch availableCNA
MicrosoftMicrosoft Teams for Android1.0.0 to before 1.0.0.20260431021.0.0.2026043102Patch availableCNA
MicrosoftMicrosoft Teams for iOS2.0.0 to before 8.3.18.3.1Patch availableCNA
MicrosoftMicrosoft Word for Android16.0.0.0 to before 16.0.19822.2003816.0.19822.20038Patch availableCNA
MicrosoftMicrosoft Word for iOS2.0.0 to before 2.106.260206172.106.26020617Patch availableCNA
  • Microsoft 365 Copilot for Android VendorMicrosoft Affected 1.0 to before 16.0.19815.10000 Fixed in 16.0.19815.10000 Patch available CNA
  • Microsoft 365 Copilot for iOS VendorMicrosoft Affected 1.0 to before 2.107.2 Fixed in 2.107.2 Patch available CNA
  • Microsoft Edge for Android VendorMicrosoft Affected 1.0.0 to before 145.3800.99 Fixed in 145.3800.99 Patch available CNA
  • Microsoft Edge for iOS VendorMicrosoft Affected 1.0.0.0 to before 145.3800.99 Fixed in 145.3800.99 Patch available CNA
  • Microsoft Excel for Android VendorMicrosoft Affected 16.0.0.0 to before 16.0.19822.20038 Fixed in 16.0.19822.20038 Patch available CNA
  • Microsoft Excel for iOS VendorMicrosoft Affected 1.0 to before 2.106.26020617 Fixed in 2.106.26020617 Patch available CNA
  • Microsoft Loop for iOS VendorMicrosoft Affected 2.0.0 to before 2.106.26020617 Fixed in 2.106.26020617 Patch available CNA
  • Microsoft OneNote VendorMicrosoft Affected 1.0.0 to before 2.106.26020617 Fixed in 2.106.26020617 Patch available CNA
  • Microsoft OneNote for Android VendorMicrosoft Affected 16.0.1 to before 16.0.19725.20142 Fixed in 16.0.19725.20142 Patch available CNA
  • Microsoft Outlook for Android VendorMicrosoft Affected 1.0 to before 5.2605 Fixed in 5.2605 Patch available CNA
  • Microsoft Outlook for iOS VendorMicrosoft Affected 1.0.0 to before 5.2605 Fixed in 5.2605 Patch available CNA
  • Microsoft Outlook for Mac VendorMicrosoft Affected 1.0.0 to before 5.2605 Fixed in 5.2605 Patch available CNA
  • Microsoft PowerBI for Android VendorMicrosoft Affected 2.0.0 to before 2.2.260210.21290750 Fixed in 2.2.260210.21290750 Patch available CNA
  • Microsoft PowerBI for iOS VendorMicrosoft Affected 1.0.0 to before 1.2.260302.2193910 Fixed in 1.2.260302.2193910 Patch available CNA
  • Microsoft PowerPoint for Android VendorMicrosoft Affected 16.0.0.0 to before 16.0.19822.20038 Fixed in 16.0.19822.20038 Patch available CNA
  • Microsoft PowerPoint for iOS VendorMicrosoft Affected 1.0 to before 2.106.26020617 Fixed in 2.106.26020617 Patch available CNA
  • Microsoft Teams for Android VendorMicrosoft Affected 1.0.0 to before 1.0.0.2026043102 Fixed in 1.0.0.2026043102 Patch available CNA
  • Microsoft Teams for iOS VendorMicrosoft Affected 2.0.0 to before 8.3.1 Fixed in 8.3.1 Patch available CNA
  • Microsoft Word for Android VendorMicrosoft Affected 16.0.0.0 to before 16.0.19822.20038 Fixed in 16.0.19822.20038 Patch available CNA
  • Microsoft Word for iOS VendorMicrosoft Affected 2.0.0 to before 2.106.26020617 Fixed in 2.106.26020617 Patch available CNA

CPE configurations NVD · 20

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:365_copilot:*:*:*:*:*:iphone_os:*:*before 2.107.2VulnerableMicrosoft
cpe:2.3:a:microsoft:365_copilot:*:*:*:*:*:android:*:*before 16.0.19815.10000VulnerableMicrosoft
cpe:2.3:a:microsoft:edge:*:*:*:*:*:android:*:*before 145.3800.99VulnerableMicrosoft
cpe:2.3:a:microsoft:edge:*:*:*:*:*:iphone_os:*:*before 145.3800.99VulnerableMicrosoft
cpe:2.3:a:microsoft:excel:*:*:*:*:*:iphone_os:*:*before 2.106.2VulnerableMicrosoft
cpe:2.3:a:microsoft:excel:*:*:*:*:*:android:*:*before 16.0.19822.20038VulnerableMicrosoft
cpe:2.3:a:microsoft:loop:*:*:*:*:*:iphone_os:*:*before 2.106VulnerableMicrosoft
cpe:2.3:a:microsoft:onenote:*:*:*:*:*:android:*:*before 16.0.19725.20142VulnerableMicrosoft
cpe:2.3:a:microsoft:onenote:-:*:*:*:*:iphone_os:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:a:microsoft:outlook:*:*:*:*:*:android:*:*before 5.2605.0VulnerableMicrosoft
  • cpe:2.3:a:microsoft:365_copilot:*:*:*:*:*:iphone_os:*:* Versions before 2.107.2 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:365_copilot:*:*:*:*:*:android:*:* Versions before 16.0.19815.10000 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:edge:*:*:*:*:*:android:*:* Versions before 145.3800.99 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:edge:*:*:*:*:*:iphone_os:*:* Versions before 145.3800.99 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:excel:*:*:*:*:*:iphone_os:*:* Versions before 2.106.2 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:excel:*:*:*:*:*:android:*:* Versions before 16.0.19822.20038 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:loop:*:*:*:*:*:iphone_os:*:* Versions before 2.106 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:onenote:*:*:*:*:*:android:*:* Versions before 16.0.19725.20142 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:onenote:-:*:*:*:*:iphone_os:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:outlook:*:*:*:*:*:android:*:* Versions before 5.2605.0 Vulnerable ·Microsoft
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:microsoft:outlook:*:*:*:*:*:iphone_os:*:*before 5.2605.0VulnerableMicrosoft
cpe:2.3:a:microsoft:outlook:-:*:*:*:*:macos:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:a:microsoft:power_bi:*:*:*:*:*:android:*:*before 2.2.260210.21290750VulnerableMicrosoft
cpe:2.3:a:microsoft:power_bi:-:*:*:*:*:iphone_os:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:a:microsoft:powerpoint:*:*:*:*:*:iphone_os:*:*before 2.106.2VulnerableMicrosoft
cpe:2.3:a:microsoft:powerpoint:*:*:*:*:*:android:*:*before 16.0.19822.20038VulnerableMicrosoft
cpe:2.3:a:microsoft:teams:*:*:*:*:*:android:*:*before 1.0.0.2026043102VulnerableMicrosoft
cpe:2.3:a:microsoft:teams:*:*:*:*:*:iphone_os:*:*before 8.3.1VulnerableMicrosoft
cpe:2.3:a:microsoft:word:*:*:*:*:*:iphone_os:*:*before 2.106.2VulnerableMicrosoft
cpe:2.3:a:microsoft:word:*:*:*:*:*:android:*:*before 16.0.19822.20038VulnerableMicrosoft
  • cpe:2.3:a:microsoft:outlook:*:*:*:*:*:iphone_os:*:* Versions before 5.2605.0 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:outlook:-:*:*:*:*:macos:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:power_bi:*:*:*:*:*:android:*:* Versions before 2.2.260210.21290750 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:power_bi:-:*:*:*:*:iphone_os:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:powerpoint:*:*:*:*:*:iphone_os:*:* Versions before 2.106.2 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:powerpoint:*:*:*:*:*:android:*:* Versions before 16.0.19822.20038 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:teams:*:*:*:*:*:android:*:* Versions before 1.0.0.2026043102 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:teams:*:*:*:*:*:iphone_os:*:* Versions before 8.3.1 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:word:*:*:*:*:*:iphone_os:*:* Versions before 2.106.2 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:word:*:*:*:*:*:android:*:* Versions before 16.0.19822.20038 Vulnerable ·Microsoft

Remediation

  • Fix · CNA Microsoft 365 Copilot for Android (Microsoft) Fixed in 16.0.19815.10000
  • Fix · CNA Microsoft 365 Copilot for iOS (Microsoft) Fixed in 2.107.2
  • Fix · CNA Microsoft Edge for Android (Microsoft) Fixed in 145.3800.99
  • Fix · CNA Microsoft Edge for iOS (Microsoft) Fixed in 145.3800.99
  • Fix · CNA Microsoft Excel for Android (Microsoft) Fixed in 16.0.19822.20038
  • Fix · CNA Microsoft Excel for iOS (Microsoft) Fixed in 2.106.26020617
  • Fix · CNA Microsoft Loop for iOS (Microsoft) Fixed in 2.106.26020617
  • Fix · CNA Microsoft OneNote (Microsoft) Fixed in 2.106.26020617
  • Fix · CNA Microsoft OneNote for Android (Microsoft) Fixed in 16.0.19725.20142
  • Fix · CNA Microsoft Outlook for Android (Microsoft) Fixed in 5.2605
  • Fix · CNA Microsoft Outlook for iOS (Microsoft) Fixed in 5.2605
  • Fix · CNA Microsoft Outlook for Mac (Microsoft) Fixed in 5.2605
  • Fix · CNA Microsoft PowerBI for Android (Microsoft) Fixed in 2.2.260210.21290750
  • Fix · CNA Microsoft PowerBI for iOS (Microsoft) Fixed in 1.2.260302.2193910
  • Fix · CNA Microsoft PowerPoint for Android (Microsoft) Fixed in 16.0.19822.20038
  • Fix · CNA Microsoft PowerPoint for iOS (Microsoft) Fixed in 2.106.26020617
  • Fix · CNA Microsoft Teams for Android (Microsoft) Fixed in 1.0.0.2026043102
  • Fix · CNA Microsoft Teams for iOS (Microsoft) Fixed in 8.3.1
  • Fix · CNA Microsoft Word for Android (Microsoft) Fixed in 16.0.19822.20038
  • Fix · CNA Microsoft Word for iOS (Microsoft) Fixed in 2.106.26020617

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Information Disclosure
Exploited
No
Publicly disclosed
No
Exploitability
Exploitation Less Likely
ProductStatusPlan or fix
Microsoft 365 Copilot for AndroidFixed 16.0.19815.10000 · Security Update
Microsoft 365 Copilot for iOSFixed 2.107.2 · Security Update
Microsoft Edge for AndroidFixed 145.3800.99 · Security Update
Microsoft Edge for iOSFixed 145.3800.99 · Security Update
Microsoft Excel for AndroidFixed 16.0.19822.20038 · Security Update
Microsoft Excel for iOSFixed 2.106.26020617 · Security Update
Microsoft Loop for iOSFixed 2.106.26020617 · Security Update
Microsoft OneNote for AndroidFixed 16.0.19725.20142 · Security Update
Microsoft OneNote for iOSFixed 2.106.26020617 · Security Update
Microsoft Outlook for AndroidFixed 5.2605 · Security Update
Microsoft Outlook for MacFixed 5.2605 · Security Update
Microsoft Outlook for iOSFixed 5.2605 · Security Update
Microsoft PowerBI for AndroidFixed 2.2.260210.21290750 · Security Update
Microsoft PowerBI for iOSFixed 1.2.260302.2193910 · Security Update
Microsoft PowerPoint for AndroidFixed 16.0.19822.20038 · Security Update
Microsoft PowerPoint for iOSFixed 2.106.26020617 · Security Update
Microsoft Teams for AndroidFixed 1.0.0.2026043102 · Security Update
Microsoft Teams for iOSFixed 8.3.1 · Security Update
Microsoft Word for AndroidFixed 16.0.19822.20038 · Security Update
Microsoft Word for iOSFixed 2.106.26020617 · Security Update

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-26133
  2. 2026-10-03 Alias added: GHSA-rjf5-cxrf-4rvw

References

Patch 1

  • TI-2025-37796 GDI+ Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2025-23775 M365 Copilot Information Disclosure Vulnerability CVSS 3.1CRITICAL 9.3
  • TI-2025-33667 GDI+ Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2021-19684 Microsoft Office app Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.6
  • TI-2026-37251 Microsoft M365 Copilot Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.9
  • TI-2026-39054 M365 Copilot Information Disclosure Vulnerability CVSS 3.1CRITICAL 9.8
See all 54 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences