What is the CVSS score of CVE-2026-41614?

CVE-2026-41614 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-41614?

Yes, a patch is available for CVE-2026-41614. Update the affected software to the latest version immediately.

M365 Copilot Desktop CVE-2026-41614

EUVD-2026-29697 MEDIUM

Improper Access Control (CWE-284)

2026-05-12 microsoft

GHSA-r8h5-x7jj-cjjx

Authentication Bypass Microsoft M365 Copilot For Desktop

6.2

CVSS 3.1 · NVD

Temporal: 5.4

Severity by source

NVD PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CIRCL (temporal)

5.4 MEDIUM

cvss

vuln.today AI

6.1 MEDIUM

Local access typically implies a logged-in user session (PR:L); spoofing inherently carries low integrity impact (I:L) since impersonation is itself an integrity violation.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:38 vuln.today

CVE Published

May 12, 2026 - 16:58 nvd

MEDIUM 6.2

DescriptionCVE.org

Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally.

AnalysisAI

Improper access control in M365 Copilot for Desktop (all versions before 19.2604.43111.0) enables a local attacker without system privileges to perform identity spoofing, resulting in high confidentiality impact with no integrity or availability consequences. The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires only local access - no authentication, elevated privileges, or user interaction is needed. No public exploit code has been identified; EPSS stands at 0.04% (12th percentile) and SSVC designates exploitation as 'none,' placing this firmly in the category of a patched but currently low-threat-activity vulnerability.

Technical ContextAI

The vulnerability is rooted in CWE-284 (Improper Access Control), meaning M365 Copilot for Desktop fails to enforce appropriate access restrictions for an identity-sensitive operation. In the context of a desktop AI assistant integrated with Microsoft 365 services, improper access control around identity handling could allow a local attacker to assume or impersonate another user's identity context - potentially gaining access to that user's Copilot session data, Microsoft 365 tokens, or AI-generated outputs scoped to another identity. The affected component is confirmed by CPE cpe:2.3:a:microsoft:m365_copilot_for_desktop:*:*:*:*:*:*:*:*, covering all releases from version 1.0.0 up to (but not including) 19.2604.43111.0. The desktop application likely communicates with Microsoft 365 backend services, and a local spoofing flaw in its access control logic could bypass identity boundary enforcement at the local process or IPC layer.

RemediationAI

Upgrade M365 Copilot for Desktop to version 19.2604.43111.0 or later, which contains the vendor-released patch per the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41614. If immediate patching is not feasible, restrict local access to affected workstations by limiting which user accounts are permitted to log in interactively, particularly on shared or multi-user systems where lateral identity spoofing is most impactful - note that this may disrupt legitimate multi-user workflows. Monitoring local process activity for unexpected interactions with M365 Copilot Desktop components can serve as a compensating detective control, though it does not prevent exploitation. Disabling M365 Copilot for Desktop entirely on high-sensitivity shared workstations until the patch is applied is the most conservative temporary mitigation, at the cost of productivity impact for affected users.