Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-26133

AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:cd90fd11b7d8d19f29372484f04468e954014de74ad4d44022cbd6f1ff24a079
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 20 assertions

{"product":"Microsoft Teams for Android","vendor":"Microsoft","versions":[{"lessThan":"1.0.0.2026043102","status":"affected","version":"1.0.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/16

{"product":"Microsoft Loop for iOS","vendor":"Microsoft","versions":[{"lessThan":"2.106.26020617","status":"affected","version":"2.0.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/6

{"product":"Microsoft Word for Android","vendor":"Microsoft","versions":[{"lessThan":"16.0.19822.20038","status":"affected","version":"16.0.0.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/18

{"product":"Microsoft Outlook for Mac","vendor":"Microsoft","versions":[{"lessThan":"5.2605","status":"affected","version":"1.0.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/11

{"product":"Microsoft Teams for iOS","vendor":"Microsoft","versions":[{"lessThan":"8.3.1","status":"affected","version":"2.0.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/17

{"product":"Microsoft Outlook for iOS","vendor":"Microsoft","versions":[{"lessThan":"5.2605","status":"affected","version":"1.0.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/10

{"product":"Microsoft Word for iOS","vendor":"Microsoft","versions":[{"lessThan":"2.106.26020617","status":"affected","version":"2.0.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/19

{"product":"Microsoft OneNote for Android","vendor":"Microsoft","versions":[{"lessThan":"16.0.19725.20142","status":"affected","version":"16.0.1","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/8

{"product":"Microsoft Edge for Android","vendor":"Microsoft","versions":[{"lessThan":"145.3800.99","status":"affected","version":"1.0.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/2

{"product":"Microsoft PowerPoint for iOS","vendor":"Microsoft","versions":[{"lessThan":"2.106.26020617","status":"affected","version":"1.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/15

{"product":"Microsoft Outlook for Android","vendor":"Microsoft","versions":[{"lessThan":"5.2605","status":"affected","version":"1.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/9

{"product":"Microsoft PowerPoint for Android","vendor":"Microsoft","versions":[{"lessThan":"16.0.19822.20038","status":"affected","version":"16.0.0.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/14

{"product":"Microsoft Excel for iOS","vendor":"Microsoft","versions":[{"lessThan":"2.106.26020617","status":"affected","version":"1.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/5

{"product":"Microsoft Edge for iOS","vendor":"Microsoft","versions":[{"lessThan":"145.3800.99","status":"affected","version":"1.0.0.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/3

{"product":"Microsoft PowerBI for Android","vendor":"Microsoft","versions":[{"lessThan":"2.2.260210.21290750","status":"affected","version":"2.0.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/12

{"product":"Microsoft PowerBI for iOS","vendor":"Microsoft","versions":[{"lessThan":"1.2.260302.2193910","status":"affected","version":"1.0.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/13

{"product":"Microsoft 365 Copilot for Android","vendor":"Microsoft","versions":[{"lessThan":"16.0.19815.10000","status":"affected","version":"1.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/0

{"product":"Microsoft OneNote","vendor":"Microsoft","versions":[{"lessThan":"2.106.26020617","status":"affected","version":"1.0.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/7

{"product":"Microsoft Excel for Android","vendor":"Microsoft","versions":[{"lessThan":"16.0.19822.20038","status":"affected","version":"16.0.0.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/4

{"product":"Microsoft 365 Copilot for iOS","vendor":"Microsoft","versions":[{"lessThan":"2.107.2","status":"affected","version":"1.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/1

Affected products and versions

20 source assertions
{"product":"Microsoft Teams for Android","vendor":"Microsoft","versions":[{"lessThan":"1.0.0.2026043102","status":"affected","version":"1.0.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/16
{"product":"Microsoft Loop for iOS","vendor":"Microsoft","versions":[{"lessThan":"2.106.26020617","status":"affected","version":"2.0.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/6
{"product":"Microsoft Word for Android","vendor":"Microsoft","versions":[{"lessThan":"16.0.19822.20038","status":"affected","version":"16.0.0.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/18
{"product":"Microsoft Outlook for Mac","vendor":"Microsoft","versions":[{"lessThan":"5.2605","status":"affected","version":"1.0.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/11
{"product":"Microsoft Teams for iOS","vendor":"Microsoft","versions":[{"lessThan":"8.3.1","status":"affected","version":"2.0.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/17
{"product":"Microsoft Outlook for iOS","vendor":"Microsoft","versions":[{"lessThan":"5.2605","status":"affected","version":"1.0.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/10
{"product":"Microsoft Word for iOS","vendor":"Microsoft","versions":[{"lessThan":"2.106.26020617","status":"affected","version":"2.0.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/19
{"product":"Microsoft OneNote for Android","vendor":"Microsoft","versions":[{"lessThan":"16.0.19725.20142","status":"affected","version":"16.0.1","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/8
{"product":"Microsoft Edge for Android","vendor":"Microsoft","versions":[{"lessThan":"145.3800.99","status":"affected","version":"1.0.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/2
{"product":"Microsoft PowerPoint for iOS","vendor":"Microsoft","versions":[{"lessThan":"2.106.26020617","status":"affected","version":"1.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/15
{"product":"Microsoft Outlook for Android","vendor":"Microsoft","versions":[{"lessThan":"5.2605","status":"affected","version":"1.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/9
{"product":"Microsoft PowerPoint for Android","vendor":"Microsoft","versions":[{"lessThan":"16.0.19822.20038","status":"affected","version":"16.0.0.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/14
{"product":"Microsoft Excel for iOS","vendor":"Microsoft","versions":[{"lessThan":"2.106.26020617","status":"affected","version":"1.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/5
{"product":"Microsoft Edge for iOS","vendor":"Microsoft","versions":[{"lessThan":"145.3800.99","status":"affected","version":"1.0.0.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/3
{"product":"Microsoft PowerBI for Android","vendor":"Microsoft","versions":[{"lessThan":"2.2.260210.21290750","status":"affected","version":"2.0.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/12
{"product":"Microsoft PowerBI for iOS","vendor":"Microsoft","versions":[{"lessThan":"1.2.260302.2193910","status":"affected","version":"1.0.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/13
{"product":"Microsoft 365 Copilot for Android","vendor":"Microsoft","versions":[{"lessThan":"16.0.19815.10000","status":"affected","version":"1.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/0
{"product":"Microsoft OneNote","vendor":"Microsoft","versions":[{"lessThan":"2.106.26020617","status":"affected","version":"1.0.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/7
{"product":"Microsoft Excel for Android","vendor":"Microsoft","versions":[{"lessThan":"16.0.19822.20038","status":"affected","version":"16.0.0.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/4
{"product":"Microsoft 365 Copilot for iOS","vendor":"Microsoft","versions":[{"lessThan":"2.107.2","status":"affected","version":"1.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/affected/1

Provider-owned CVSS observations

1 source assertion
{"metric":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N/E:U/RL:O/RC:C","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-77","description":"CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')","lang":"en-US","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion
{"name":"M365 Copilot Information Disclosure Vulnerability","tags":["vendor-advisory","patch"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26133"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:89bd00ba1057f5f434fafed0ec29238a8b99516f94870e6a72240cf33588a2d1 · sha256:cd2eb58777c1c54b… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer