Microsoft 365 Copilot CVE-2026-58617

The only prerequisite established by the CVSS vector is network reachability of the Microsoft 365 Copilot for iOS service, with no privileges (PR:N) and no user interaction (UI:N) required per the vendor scoring; the affected client must be running a version below 2.111.4. The description does not name a specific non-default feature or configuration toggle - it states only that improper access control permits an unauthorized attacker to elevate privileges over a network. Limiting factors: SSVC marks the vulnerability as not automatable and exploitation as none, and EPSS is low (0.67%), indicating exploitation is non-trivial in practice and not observed; additionally, the apparent mismatch between an iOS client app and a fully unauthenticated network vector suggests some session or account context may in reality be needed - this should be confirmed against the Microsoft advisory, as the public data does not specify the exact authorization boundary that is bypassed.

The signals are conflicting and warrant caution. The CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N, total C/I/A impact) paints a worst-case picture of trivial, unauthenticated, remote exploitation, and SSVC rates the technical impact as 'total'. However, SSVC also records Exploitation as 'none' and Automatable as 'no', and the EPSS probability is only 0.67% (48th percentile) - inconsistent with a widely or easily exploited critical bug. There is no CISA KEV listing and no public exploit identified at time of analysis. The reconciliation is that this is a high-severity-but-not-yet-exploited issue: if the CVSS vector is accurate, the potential impact is severe, but the lack of automation, absence of a POC, and low EPSS suggest it is not currently under active or opportunistic attack. Note the tension between an iOS client app and a PR:N/UI:N network privilege-escalation rating - verify with the Microsoft advisory whether any account/session context is actually required, as vendor CVSS for cloud-connected mobile apps is sometimes scored conservatively as network-reachable.

Given the AV:N/AC:L/PR:N vector, an attacker interacts with the Copilot for iOS service or client over the network and exploits the missing access-control check to escalate privileges and read or modify data they should not be able to reach. No user interaction is required (UI:N) and no exploit code has been published, so realistic exploitation would require an attacker to independently discover the authorization flaw. Success would grant high confidentiality, integrity and availability impact within the affected scope.