Microsoft 365 Copilot For Ios
Monthly
Elevation of privilege in Microsoft 365 Copilot for iOS (versions 1.0 through builds prior to 2.111.4) lets a network-based attacker bypass improper access controls (CWE-284) to gain unauthorized elevated privileges. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates this 9.8 Critical with total confidentiality, integrity and availability impact, though SSVC records exploitation status as none and there is no public exploit identified at time of analysis. EPSS is modest at 0.67% (48th percentile), indicating no observed exploitation activity despite the high theoretical severity.
Remote code execution in the Microsoft 365 Copilot mobile apps for Android and iOS lets an unauthenticated attacker run code across a security boundary by getting a user to interact with crafted content (CWE-77 command injection). The CVSS 9.6 rating reflects network reach, low complexity, no privileges, and a changed scope with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, but a vendor patch is available and the flaw was self-reported by Microsoft.
Command injection in Microsoft 365 Copilot for iOS allows remote unauthenticated attackers to tamper with system integrity over the network when a user is convinced to interact with malicious content. The flaw carries a critical CVSS score of 9.3 with a scope change indicating impact beyond the vulnerable component, though no public exploit identified at time of analysis. An official vendor patch is available via MSRC.
CVE-2026-26133 is an AI command injection vulnerability in Microsoft 365 Copilot and multiple Microsoft mobile/desktop applications that allows remote attackers to disclose sensitive information through crafted AI prompts. The vulnerability affects numerous Microsoft products across iOS, Android, and macOS platforms, requires user interaction, and has a patch available from Microsoft with no current evidence of active exploitation (not in KEV).
Elevation of privilege in Microsoft 365 Copilot for iOS (versions 1.0 through builds prior to 2.111.4) lets a network-based attacker bypass improper access controls (CWE-284) to gain unauthorized elevated privileges. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates this 9.8 Critical with total confidentiality, integrity and availability impact, though SSVC records exploitation status as none and there is no public exploit identified at time of analysis. EPSS is modest at 0.67% (48th percentile), indicating no observed exploitation activity despite the high theoretical severity.
Remote code execution in the Microsoft 365 Copilot mobile apps for Android and iOS lets an unauthenticated attacker run code across a security boundary by getting a user to interact with crafted content (CWE-77 command injection). The CVSS 9.6 rating reflects network reach, low complexity, no privileges, and a changed scope with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, but a vendor patch is available and the flaw was self-reported by Microsoft.
Command injection in Microsoft 365 Copilot for iOS allows remote unauthenticated attackers to tamper with system integrity over the network when a user is convinced to interact with malicious content. The flaw carries a critical CVSS score of 9.3 with a scope change indicating impact beyond the vulnerable component, though no public exploit identified at time of analysis. An official vendor patch is available via MSRC.
CVE-2026-26133 is an AI command injection vulnerability in Microsoft 365 Copilot and multiple Microsoft mobile/desktop applications that allows remote attackers to disclose sensitive information through crafted AI prompts. The vulnerability affects numerous Microsoft products across iOS, Android, and macOS platforms, requires user interaction, and has a patch available from Microsoft with no current evidence of active exploitation (not in KEV).