Microsoft 365 Copilot CVE-2026-41090

The victim must be running the Microsoft 365 Copilot application on iOS and must interact with attacker-controlled content processed by Copilot - the CVSS vector requires UI:R (user interaction), so passive or fully automated exploitation against a target is not in scope, but no authentication to the attacker's infrastructure is required since PR:N applies to the attacker side. Exploitation is limited to environments where the iOS Copilot client is installed and used to consume untrusted input (documents, emails, web content, or chat messages); desktop, web, and Android Copilot clients are not listed in the supplied CPE data and should be verified separately with the vendor. The temporal exploit-code maturity is reported as Unproven (E:U), which further limits realistic risk to defenders who patch promptly.

The CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N indicates a network-reachable, low-complexity, unauthenticated attack that requires user interaction, with high confidentiality and integrity impact and a changed scope - collectively producing the 9.3 base score. Temporal metrics (E:U/RL:O/RC:C) report that the exploit is currently unproven, an official fix is available, and the report is confirmed, which moderates the practical urgency relative to the raw base score. The CVE is not listed in CISA KEV and no public exploit identified at time of analysis, so widespread opportunistic exploitation is not currently expected; however, the UI:R requirement combined with Copilot's exposure to attacker-controlled content (emails, documents, web pages summarized by the assistant) makes social-engineering or indirect prompt-injection delivery a realistic vector. EPSS data was not provided, and SSVC decision-framework values were not supplied, so prioritization must rely on the CVSS and KEV/POC signals available here.

An attacker delivers a crafted payload - for example, a malicious email, shared document, or web resource - that the victim asks Microsoft 365 Copilot for iOS to summarize or act on; embedded command syntax breaks out of the intended data context and is processed as a command by Copilot, tampering with integrity-impacting operations across the changed scope. Because no public exploit is identified at time of analysis, this scenario is hypothetical but consistent with the CVSS vector (AV:N, UI:R, S:C, I:H).