EUVD-2026-44305
GHSA-fw44-xwgm-pf69
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable AI client tied to authenticated M365 sessions, so PR:L is more defensible than PR:N; total impact justifies C/I/A:H with unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network.
AnalysisAI
Elevation of privilege in Microsoft 365 Copilot for iOS (versions 1.0 through builds prior to 2.111.4) lets a network-based attacker bypass improper access controls (CWE-284) to gain unauthorized elevated privileges. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates this 9.8 Critical with total confidentiality, integrity and availability impact, though SSVC records exploitation status as none and there is no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The only prerequisite established by the CVSS vector is network reachability of the Microsoft 365 Copilot for iOS service, with no privileges (PR:N) and no user interaction (UI:N) required per the vendor scoring; the affected client must be running a version below 2.111.4. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are conflicting and warrant caution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Given the AV:N/AC:L/PR:N vector, an attacker interacts with the Copilot for iOS service or client over the network and exploits the missing access-control check to escalate privileges and read or modify data they should not be able to reach. No user interaction is required (UI:N) and no exploit code has been published, so realistic exploitation would require an attacker to independently discover the authorization flaw. … |
| Remediation | Vendor-released patch: update Microsoft 365 Copilot for iOS to version 2.111.4 or later, which is the first fixed build per the EUVD version range and the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58617. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all iOS devices running Microsoft 365 Copilot and identify users on affected versions prior to 2.111.4; immediately notify them of the vulnerability. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in the Microsoft 365 Copilot mobile apps for Android and iOS lets an unauthenticated attacker run
CVE-2026-26133 is an AI command injection vulnerability in Microsoft 365 Copilot and multiple Microsoft mobile/desktop a
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today