CVE-2026-26133

Microsoft 365 Copilot is an AI assistant that can help people work with Microsoft documents and data. In this vulnerability, attackers can try to “trick” the AI into processing attacker-supplied instructions, which may cause confidential information to be revealed. Think of it like getting someone’s assistant to follow a malicious script instead of your request, causing private info to come back.

This matters if your business uses Microsoft 365 Copilot and the listed Microsoft apps (Edge, Excel, Loop, OneNote, Outlook, Power BI, PowerPoint, Teams, Word). It is network-reachable without needing an attacker account, but it also requires user interaction, so it’s most relevant to how employees use Copilot and what they click or open.

Based on the findings, treat this as a risk only in realistic scenarios where an attacker can reach your Copilot usage flow and trigger the needed user interaction.

This is AMBER because the issue can expose confidential information, and it’s described as an attacker-driven injection that retrieves data. While there’s no confirmed public exploit code on record and no KEV listing, Microsoft has provided fixed versions for multiple products, so updates should be prioritized.

1. Confirm if you’re in scope: Identify whether your organization uses Microsoft 365 Copilot and any of these apps: Microsoft Edge, Microsoft Excel, Loop, OneNote, Outlook, Power BI, PowerPoint, Teams, and Word.
2. Inventory installed versions: For each used app, record the current version number from your admin tools or device/app “About” screens (for web/desktop, confirm the deployed build).
3. Verify you’re at or above the fixed versions:
   • 365 copilot → fixed in 2.107.2
   • microsoft edge → fixed in 145.3800.99
   • microsoft excel → fixed in 2.106.2
   • loop → fixed in 2.106
   • onenote → fixed in 16.0.19725.20142
   • outlook → fixed in 5.2605.0
   • power bi → fixed in 2.2.260210.21290750
   • powerpoint → fixed in 2.106.2
   • teams → fixed in 1.0.0.2026043102
   • word → fixed in 2.106.2
   • Microsoft 365 Copilot for Android → fixed in 16.0.19815.10000
   • Microsoft 365 Copilot for iOS → fixed in 2.107.2
4. Upgrade plan: Roll out updates through your normal Microsoft update channels (including mobile app store updates) to reach the fixed versions above.
5. If patching is delayed (workaround): Because the findings indicate user interaction is required, reduce risk by tightening controls around where Copilot is used and strengthening employee guidance (e.g., don’t run or respond to suspicious prompts, attachments, or links that ask users to interact with Copilot). This does not replace updating, but it can reduce exposure while you patch.
6. What to monitor after updating: Watch for unusual prompt/interaction patterns related to Copilot use and any alerts from your Microsoft security tooling for abnormal data access or odd usage activity.
7. Reference: Follow Microsoft’s remediation guidance for CVE-2026-26133: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26133

CVE-2026-26133 (CWE-77) is an information disclosure vulnerability tied to an AI “command injection” weakness in Microsoft 365 Copilot. Findings indicate an attacker can inject commands over the network without authentication and can retrieve confidential data, but exploitation requires user interaction.

Traffic light verdict is AMBER. There is no entry in CISA KEV and no public exploit code recorded in the findings; EPSS is reported as a prediction (0.4% with flat trend), but that prediction is not treated as proof of widespread exploitation. Microsoft has fixed multiple related products (including Edge, Office apps, Teams, and mobile Copilot) in the specific version numbers listed in the patch findings. KEV (CISA Known Exploited Vulnerabilities) would indicate confirmed real-world exploitation, but it is not listed here.