What is the CVSS score of CVE-2026-48561?

CVE-2026-48561 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of Microsoft 365 Copilot For Android are affected by CVE-2026-48561?

Microsoft 365 Copilot mobile apps (Android and iOS) contain a critical remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary commands when users interact with…. A patch is available.

How to fix or mitigate CVE-2026-48561?

Within 24 hours, audit your enterprise app store, MDM infrastructure (Intune, MobileIron, etc.), and employee-owned devices to identify all Microsoft 365 Copilot installations and push the patched version through your distribution channel; simultaneously alert users to update manually if using personal devices. Within 7 days, verify through endpoint telemetry and MDM reporting that 100% of known Copilot installations have received the patched build, and analyze audit logs for any suspicious Copilot activity during the exposure window. Within 30 days, enforce a policy blocking outdated Copilot versions from connecting to corporate networks, deploy mobile threat defense scanning to Copilot-equipped devices, and document the remediation timeline for audit compliance.

Microsoft 365 Copilot For Android CVE-2026-48561

EUVD-2026-43965 CRITICAL

Command Injection (CWE-77)

2026-07-14 microsoft

GHSA-m97f-w34x-vq3w

Command Injection Microsoft Microsoft 365 Copilot For Android Microsoft 365 Copilot For Ios

9.6

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from Vendor (microsoft) · only source for this CVE.

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 17:34 vuln.today

CVE Published

Jul 14, 2026 - 17:04 nvd

CRITICAL 9.6

DescriptionCVE.org

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in the Microsoft 365 Copilot mobile apps for Android and iOS lets an unauthenticated attacker run code across a security boundary by getting a user to interact with crafted content (CWE-77 command injection). The CVSS 9.6 rating reflects network reach, low complexity, no privileges, and a changed scope with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, but a vendor patch is available and the flaw was self-reported by Microsoft.