What is the CVSS score of CVE-2026-42893?

CVE-2026-42893 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Microsoft Outlook For Ios are affected by CVE-2026-42893?

Microsoft Outlook for iOS (versions 1.0.0-5.2617.0) contains a command injection vulnerability that could allow unauthorized data tampering when users interact with crafted content.. A patch is available.

How to fix or mitigate CVE-2026-42893?

Within 24 hours: Identify all Outlook for iOS users and communicate the availability of the vendor patch; prioritize any users running versions 1.0.0 through 5.2617.0. Within 7 days: Deploy the patched version of Outlook for iOS across all affected devices via mobile device management (MDM) tools and validate deployment completion. Within 30 days: Confirm full remediation across the iOS user base and establish a recurring process to monitor and deploy subsequent Outlook security updates within 7 days of release.

Microsoft Outlook For Ios CVE-2026-42893

EUVD-2026-29716 HIGH

Command Injection (CWE-77)

2026-05-12 microsoft

GHSA-h35m-vhjw-vqxj

Command Injection Microsoft Microsoft Outlook For Ios

7.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

ENISA EUVD

HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:02 vuln.today

CVE Published

May 12, 2026 - 16:59 nvd

HIGH 7.4

DescriptionCVE.org

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to perform tampering over a network.

AnalysisAI

Tampering via command injection affects Microsoft Outlook for iOS versions 1.0.0 through 5.2617.0, where a network-based attacker can craft content that, once the victim interacts with it, injects and executes unauthorized commands to alter data integrity. The vulnerability carries CVSS 7.4 (integrity-only impact, scope changed) and requires user interaction; there is no public exploit identified at time of analysis, and EPSS is very low at 0.04%. Note a source conflict: the CVE description names 'M365 Copilot' while the CPE and EUVD affected-version data point specifically to Outlook for iOS.