Microsoft Outlook For Ios
Monthly
Tampering via command injection affects Microsoft Outlook for iOS versions 1.0.0 through 5.2617.0, where a network-based attacker can craft content that, once the victim interacts with it, injects and executes unauthorized commands to alter data integrity. The vulnerability carries CVSS 7.4 (integrity-only impact, scope changed) and requires user interaction; there is no public exploit identified at time of analysis, and EPSS is very low at 0.04%. Note a source conflict: the CVE description names 'M365 Copilot' while the CPE and EUVD affected-version data point specifically to Outlook for iOS.
CVE-2026-26133 is an AI command injection vulnerability in Microsoft 365 Copilot and multiple Microsoft mobile/desktop applications that allows remote attackers to disclose sensitive information through crafted AI prompts. The vulnerability affects numerous Microsoft products across iOS, Android, and macOS platforms, requires user interaction, and has a patch available from Microsoft with no current evidence of active exploitation (not in KEV).
Tampering via command injection affects Microsoft Outlook for iOS versions 1.0.0 through 5.2617.0, where a network-based attacker can craft content that, once the victim interacts with it, injects and executes unauthorized commands to alter data integrity. The vulnerability carries CVSS 7.4 (integrity-only impact, scope changed) and requires user interaction; there is no public exploit identified at time of analysis, and EPSS is very low at 0.04%. Note a source conflict: the CVE description names 'M365 Copilot' while the CPE and EUVD affected-version data point specifically to Outlook for iOS.
CVE-2026-26133 is an AI command injection vulnerability in Microsoft 365 Copilot and multiple Microsoft mobile/desktop applications that allows remote attackers to disclose sensitive information through crafted AI prompts. The vulnerability affects numerous Microsoft products across iOS, Android, and macOS platforms, requires user interaction, and has a patch available from Microsoft with no current evidence of active exploitation (not in KEV).