EUVD-2026-12111
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Lifecycle Timeline
4Tags
Description
AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.
Analysis
CVE-2026-26133 is an AI command injection vulnerability in Microsoft 365 Copilot and multiple Microsoft mobile/desktop applications that allows remote attackers to disclose sensitive information through crafted AI prompts. The vulnerability affects numerous Microsoft products across iOS, Android, and macOS platforms, requires user interaction, and has a patch available from Microsoft with no current evidence of active exploitation (not in KEV).
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Identify and inventory all affected Microsoft applications (Copilot, mobile/desktop apps) deployed across the organization and assess which users have access. Within 7 days: Deploy available Microsoft patches across all affected systems, prioritizing business-critical users and those handling sensitive data; communicate patch requirements to end users. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today