Read the docs
TI-2026-29734 Aliases CVE-2026-41100GHSA-6gm9-cppw-hvx5

Microsoft 365 Copilot for Android Spoofing Vulnerability

Priority LOW 20CWE-284Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from Microsoft.

Summary

Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00249 16th percentileScored 2026-11-07
Fix Fixed Microsoft 365 Copilot for Android (Microsoft): 16.0.19822.20190Microsoft Excel for Android (Microsoft): 16.0.19822.20190+4 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft 365 Copilot for Android1.0 to before 16.0.19822.2019016.0.19822.20190Patch availableCNA
MicrosoftMicrosoft Excel for Android16.0.0.0 to before 16.0.19822.2019016.0.19822.20190Patch availableCNA
MicrosoftMicrosoft Loop for Android1.0.0 to before 16.0.19822.2019016.0.19822.20190Patch availableCNA
MicrosoftMicrosoft OneNote for Android16.0.1 to before 16.0.19822.2019016.0.19822.20190Patch availableCNA
MicrosoftMicrosoft PowerPoint for Android16.0.0.0 to before 16.0.19822.2019016.0.19822.20190Patch availableCNA
MicrosoftMicrosoft Word for Android16.0.0.0 to before 16.0.19822.2019016.0.19822.20190Patch availableCNA
  • Microsoft 365 Copilot for Android VendorMicrosoft Affected 1.0 to before 16.0.19822.20190 Fixed in 16.0.19822.20190 Patch available CNA
  • Microsoft Excel for Android VendorMicrosoft Affected 16.0.0.0 to before 16.0.19822.20190 Fixed in 16.0.19822.20190 Patch available CNA
  • Microsoft Loop for Android VendorMicrosoft Affected 1.0.0 to before 16.0.19822.20190 Fixed in 16.0.19822.20190 Patch available CNA
  • Microsoft OneNote for Android VendorMicrosoft Affected 16.0.1 to before 16.0.19822.20190 Fixed in 16.0.19822.20190 Patch available CNA
  • Microsoft PowerPoint for Android VendorMicrosoft Affected 16.0.0.0 to before 16.0.19822.20190 Fixed in 16.0.19822.20190 Patch available CNA
  • Microsoft Word for Android VendorMicrosoft Affected 16.0.0.0 to before 16.0.19822.20190 Fixed in 16.0.19822.20190 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:365_copilot:*:*:*:*:*:android:*:*before 16.0.19822.20190VulnerableMicrosoft
  • cpe:2.3:a:microsoft:365_copilot:*:*:*:*:*:android:*:* Versions before 16.0.19822.20190 Vulnerable ·Microsoft

Remediation

  • Fix · CNA Microsoft 365 Copilot for Android (Microsoft) Fixed in 16.0.19822.20190
  • Fix · CNA Microsoft Excel for Android (Microsoft) Fixed in 16.0.19822.20190
  • Fix · CNA Microsoft Loop for Android (Microsoft) Fixed in 16.0.19822.20190
  • Fix · CNA Microsoft OneNote for Android (Microsoft) Fixed in 16.0.19822.20190
  • Fix · CNA Microsoft PowerPoint for Android (Microsoft) Fixed in 16.0.19822.20190
  • Fix · CNA Microsoft Word for Android (Microsoft) Fixed in 16.0.19822.20190

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Spoofing
Exploited
No
Publicly disclosed
No
Exploitability
Exploitation Unlikely
ProductStatusPlan or fix
Microsoft 365 Copilot for AndroidFixed 16.0.19822.20190 · Security Update
Microsoft Excel for AndroidFixed 16.0.19822.20190 · Security Update
Microsoft Loop for AndroidFixed 16.0.19822.20190 · Security Update
Microsoft OneNote for AndroidFixed 16.0.19822.20190 · Security Update
Microsoft PowerPoint for AndroidFixed 16.0.19822.20190 · Security Update
Microsoft Word for AndroidFixed 16.0.19822.20190 · Security Update

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41100
  2. 2026-10-03 Alias added: GHSA-6gm9-cppw-hvx5

References

Patch 1

  • TI-2025-37796 GDI+ Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2025-23775 M365 Copilot Information Disclosure Vulnerability CVSS 3.1CRITICAL 9.3
  • TI-2025-33667 GDI+ Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2021-19684 Microsoft Office app Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.6
  • TI-2026-37251 Microsoft M365 Copilot Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.9
  • TI-2026-39054 M365 Copilot Information Disclosure Vulnerability CVSS 3.1CRITICAL 9.8
See all 54 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences