What is the CVSS score of CVE-2026-58617?

CVE-2026-58617 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Microsoft 365 Copilot are affected by CVE-2026-58617?

A critical elevation-of-privilege vulnerability in Microsoft 365 Copilot for iOS (versions prior to 2.111.4) allows unauthenticated network attackers to bypass access controls and gain unauthorized…. A patch is available.

How to fix or mitigate CVE-2026-58617?

Within 24 hours, inventory all iOS devices running Microsoft 365 Copilot and identify users on affected versions prior to 2.111.4; immediately notify them of the vulnerability. Within 7 days, deploy a mandatory upgrade requirement to version 2.111.4 or later organization-wide-configure mobile device management (MDM) policies to enforce compliance automatically where available. Within 30 days, complete a full compliance audit verifying all Copilot iOS instances are on patched versions and review historical access logs from the exposure period for unauthorized privilege elevation attempts.

Microsoft 365 Copilot CVE-2026-58617

EUVD-2026-44305 CRITICAL

Improper Access Control (CWE-284)

2026-07-14 microsoft

GHSA-fw44-xwgm-pf69

Authentication Bypass Apple Microsoft Microsoft 365 Copilot For Ios

9.8

CVSS 3.1 · NVD

Temporal: 7.1

Severity by source

Vendor (microsoft) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

7.1 HIGH

cvss

vuln.today AI

8.8 HIGH

Network-reachable AI client tied to authenticated M365 sessions, so PR:L is more defensible than PR:N; total impact justifies C/I/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 16, 2026 - 20:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 16, 2026 - 20:22 vuln.today

cvss_changed

Severity Changed

Jul 16, 2026 - 20:22 NVD

HIGH CRITICAL

CVSS changed

Jul 16, 2026 - 20:22 NVD

8.1 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Jul 14, 2026 - 18:46 vuln.today

CVE Published

Jul 14, 2026 - 17:10 nvd

HIGH 8.1

DescriptionNVD

Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network.

AnalysisAI

Elevation of privilege in Microsoft 365 Copilot for iOS (versions 1.0 through builds prior to 2.111.4) lets a network-based attacker bypass improper access controls (CWE-284) to gain unauthorized elevated privileges. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates this 9.8 Critical with total confidentiality, integrity and availability impact, though SSVC records exploitation status as none and there is no public exploit identified at time of analysis. EPSS is modest at 0.67% (48th percentile), indicating no observed exploitation activity despite the high theoretical severity.

Technical ContextAI

The affected component is the Microsoft 365 Copilot client application for Apple iOS (CPE cpe:2.3:a:microsoft:microsoft_365_copilot_for_ios), an AI assistant that integrates with Microsoft 365 services and user tenant data. The root cause is classified as CWE-284 Improper Access Control, meaning the application fails to correctly enforce authorization boundaries on a network-facing operation, allowing an actor to obtain privileges beyond those intended. Because Microsoft classifies this as an elevation-of-privilege issue reachable over a network, the flaw likely resides in server-side or client-server authorization handling rather than solely on-device logic, though Microsoft's advisory does not publish the precise mechanism.

RemediationAI

Vendor-released patch: update Microsoft 365 Copilot for iOS to version 2.111.4 or later, which is the first fixed build per the EUVD version range and the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58617. Deploy the update via the Apple App Store or your mobile device management (MDM) platform, and enforce the minimum app version in Intune/MDM app-protection policies so out-of-date clients cannot access corporate Microsoft 365 data. As Microsoft has not documented a supported workaround, the compensating control for devices that cannot be immediately updated is to block or restrict Copilot access through Conditional Access or app-protection policy until the patched version is confirmed installed; the trade-off is loss of Copilot functionality for those users. Confirm the fix version in your fleet inventory rather than assuming the store auto-update has applied.