CVE-2026-26133
AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.
Published Mar 16, 2026 · updated Jun 17, 2026 · microsoft 365 copilot
AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 16, 2026 · NIST NVD
Detected
AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.
Jun 17, 2026 · NIST NVD
Updated
AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.
Affected
- cpe microsoft/365 copilotversion unspecified
- cpe microsoft/edgeversion unspecified
- cpe microsoft/excelversion unspecified
- cpe microsoft/loopversion unspecified
- cpe microsoft/onenoteversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-26133
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-26133
AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.
nvd.nist.gov