Microsoft Outlook For Ios
Monthly
Command injection in Microsoft Outlook for iOS before 5.2617.1 can let remote unauthenticated attackers tamper with data over the network; the CVSS 3.1 vector rates integrity impact high and confidentiality/availability impact none. No public exploit was identified at time of analysis, EPSS is 0.04% (14th percentile), and SSVC records exploitation none with automatable no. The CVE description names M365 Copilot while CPE and EUVD metadata point to Outlook for iOS, so defenders should confirm the affected component with Microsoft MSRC.
CVE-2026-26133 is an AI command injection vulnerability in Microsoft 365 Copilot and multiple Microsoft mobile/desktop applications that allows remote attackers to disclose sensitive information through crafted AI prompts. The vulnerability affects numerous Microsoft products across iOS, Android, and macOS platforms, requires user interaction, and has a patch available from Microsoft with no current evidence of active exploitation (not in KEV).
Command injection in Microsoft Outlook for iOS before 5.2617.1 can let remote unauthenticated attackers tamper with data over the network; the CVSS 3.1 vector rates integrity impact high and confidentiality/availability impact none. No public exploit was identified at time of analysis, EPSS is 0.04% (14th percentile), and SSVC records exploitation none with automatable no. The CVE description names M365 Copilot while CPE and EUVD metadata point to Outlook for iOS, so defenders should confirm the affected component with Microsoft MSRC.
CVE-2026-26133 is an AI command injection vulnerability in Microsoft 365 Copilot and multiple Microsoft mobile/desktop applications that allows remote attackers to disclose sensitive information through crafted AI prompts. The vulnerability affects numerous Microsoft products across iOS, Android, and macOS platforms, requires user interaction, and has a patch available from Microsoft with no current evidence of active exploitation (not in KEV).