CVE-2026-26133: M365 Copilot Information Disclosure Vulnerability

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-13 · updated 2026-06-19
Weakness: CWE-77

Description

AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Affected products

Microsoft 365 Copilot: before 2.107.2; before 16.0.19815.10000 — fixed in 16.0.19815.10000, 2.107.2
Microsoft Edge: before 145.3800.99 — fixed in 145.3800.99
Microsoft Excel 2013 Service Pack 1: before 2.106.2; before 16.0.19822.20038 — fixed in 16.0.19822.20038, 2.106.2
Microsoft Loop: before 2.106 — fixed in 2.106
Microsoft OneNote for Android: before 16.0.19725.20142 — fixed in 16.0.19725.20142
Microsoft Outlook: before 5.2605.0 — fixed in 5.2605.0
Microsoft Power Bi: before 2.2.260210.21290750 — fixed in 2.2.260210.21290750
Microsoft PowerPoint for Android: before 2.106.2; before 16.0.19822.20038 — fixed in 16.0.19822.20038, 2.106.2
Microsoft Teams: before 1.0.0.2026043102; before 8.3.1 — fixed in 1.0.0.2026043102, 8.3.1
Microsoft Word for Android: before 2.106.2; before 16.0.19822.20038 — fixed in 16.0.19822.20038, 2.106.2
Microsoft 365 Copilot: from 1.0 before 2.107.2 — fixed in 2.107.2
Microsoft Edge: from 1.0.0 before 145.3800.99 — fixed in 145.3800.99
Microsoft 365 Copilot for Android: from 1.0 before 16.0.19815.10000 — fixed in 16.0.19815.10000
Microsoft Excel for Android: from 16.0.0.0 before 16.0.19822.20038 — fixed in 16.0.19822.20038
Microsoft Excel for iOS: from 1.0 before 2.106.26020617 — fixed in 2.106.26020617
Microsoft Loop for iOS: from 2.0.0 before 2.106.26020617 — fixed in 2.106.26020617
Microsoft Outlook for Mac: from 1.0.0 before 5.2605 — fixed in 5.2605
Microsoft PowerBI for Android: from 2.0.0 before 2.2.260210.21290750 — fixed in 2.2.260210.21290750
Microsoft PowerBI for iOS: from 1.0.0 before 1.2.260302.2193910 — fixed in 1.2.260302.2193910
Microsoft PowerPoint for iOS: from 1.0 before 2.106.26020617 — fixed in 2.106.26020617
Microsoft Word for iOS: from 2.0.0 before 2.106.26020617 — fixed in 2.106.26020617
Microsoft OneNote for Android: from 1.0.0 before 2.106.26020617 — fixed in 2.106.26020617
Microsoft Outlook: from 1.0 before 5.2605 — fixed in 5.2605
Microsoft PowerPoint for Android: from 16.0.0.0 before 16.0.19822.20038 — fixed in 16.0.19822.20038
Microsoft Teams: from 1.0.0 before 1.0.0.2026043102 — fixed in 1.0.0.2026043102
Microsoft Word for Android: from 16.0.0.0 before 16.0.19822.20038 — fixed in 16.0.19822.20038

How to fix

Upgrade to a fixed version: Microsoft 365 Copilot 16.0.19815.10000, 2.107.2; Microsoft Edge 145.3800.99; Microsoft Excel 2013 Service Pack 1 16.0.19822.20038, 2.106.2; Microsoft Loop 2.106; Microsoft OneNote for Android 16.0.19725.20142; Microsoft Outlook 5.2605.0; Microsoft Power Bi 2.2.260210.21290750; Microsoft PowerPoint for Android 16.0.19822.20038, 2.106.2; Microsoft Teams 1.0.0.2026043102, 8.3.1; Microsoft Word for Android 16.0.19822.20038, 2.106.2; Microsoft 365 Copilot 2.107.2; Microsoft Edge 145.3800.99. Check the vendor advisory for mitigations.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26133

Get alerted when CVE-2026-26133 or the next vulnerability affects your stack