What is the CVSS score of CVE-2026-41100?

CVE-2026-41100 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-41100?

Yes, a patch is available for CVE-2026-41100. Update the affected software to the latest version immediately.

M365 Copilot CVE-2026-41100

EUVD-2026-29686 MEDIUM

Improper Access Control (CWE-284)

2026-05-12 microsoft

GHSA-6gm9-cppw-hvx5

Authentication Bypass Microsoft Microsoft 365 Copilot For Android

4.4

CVSS 3.1 · NVD

Temporal: 3.9

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CIRCL (temporal)

3.9 LOW

cvss

vuln.today AI

4.4 MEDIUM

Local attack vector with low-privilege requirement confirmed; limited C and I impact from spoofing; no availability impact; scope unchanged.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:55 vuln.today

CVE Published

May 12, 2026 - 16:58 nvd

MEDIUM 4.4

DescriptionCVE.org

Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally.

AnalysisAI

Spoofing via improper access control in Microsoft 365 Copilot for Android (versions prior to 16.0.19822.20190) enables a locally authenticated attacker with low privileges to manipulate identity or content presentation within the application. The CVSS vector (AV:L/PR:L) confirms exploitation requires prior local access and an authenticated foothold on the device - this is not a remote or unauthenticated threat. No public exploit code exists and no active exploitation has been identified; EPSS sits at 0.04% (11th percentile) and CISA SSVC rates it non-automatable with only partial technical impact.

Technical ContextAI

The vulnerability is rooted in CWE-284 (Improper Access Control), meaning the application fails to adequately enforce authorization boundaries for certain local operations, allowing a lower-privileged user or process on the Android device to perform actions that should be restricted - specifically spoofing. The affected component is the Microsoft 365 Copilot Android application (CPE: cpe:2.3:a:microsoft:microsoft_365_copilot_for_android:*:*:*:*:*:*:*:*), covering version 1.0 up to but not including build 16.0.19822.20190. On Android, 'local' access in this context implies an attacker who either shares the device or has obtained a low-privilege execution context (e.g., another app with appropriate permissions or a secondary device account), and can interact with the Copilot app's local IPC, intents, or content providers without proper validation.

RemediationAI

The primary fix is to update Microsoft 365 Copilot for Android to version 16.0.19822.20190 or later via the Google Play Store; this is confirmed as a vendor-released patch per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41100. Enterprise administrators using Microsoft Intune or other MDM solutions should push the update as part of the standard patch cycle and verify managed devices have received the update. As a compensating control prior to patching, organizations can restrict access to the M365 Copilot Android application on sensitive shared devices through conditional access policies in Microsoft Entra ID, limiting which users or device compliance states may launch the app - this reduces the pool of potential local attackers. Note that restricting app access may impact user productivity on legitimate BYOD devices.