Mar 2026: M365 Copilot Information Disclosure Vulnerability
CVE-2026-26133 Published on March 13, 2026

M365 Copilot Information Disclosure Vulnerability
AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Vendor Advisory NVD

Weakness Type

What is a Command Injection Vulnerability?

The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

CVE-2026-26133 has been classified to as a Command Injection vulnerability or weakness.

Products Associated with CVE-2026-26133

Want to know whenever a new CVE is published for Microsoft products? stack.watch will email you.

Microsoft Onenote For Ios

Microsoft Outlook

Microsoft Outlook 2016

Microsoft 365 Copilot Ios

Microsoft Edge Browser

Microsoft Teams

Microsoft Excel

Microsoft Word

Microsoft Powerpoint

Microsoft Loop

Microsoft 365 Copilot Android

Microsoft Power Bi Android

Microsoft Power Bi Ios

Microsoft Onenote For Android

Affected Versions

Microsoft 365 Copilot for Android:

Version 1.0 and below 16.0.19815.10000 is affected.

Microsoft 365 Copilot for iOS:

Version 1.0 and below 2.107.2 is affected.

Microsoft Edge for Android:

Version 1.0.0 and below 145.3800.99 is affected.

Microsoft Edge for iOS:

Version 1.0.0.0 and below 145.3800.99 is affected.

Microsoft Excel for Android:

Version 16.0.0.0 and below 16.0.19822.20038 is affected.

Microsoft Excel for iOS:

Version 1.0 and below 2.106.26020617 is affected.

Microsoft Loop for iOS:

Version 2.0.0 and below 2.106.26020617 is affected.

Microsoft OneNote:

Version 1.0.0 and below 2.106.26020617 is affected.

Microsoft OneNote for Android:

Version 16.0.1 and below 16.0.19725.20142 is affected.

Microsoft Outlook for Android:

Version 1.0 and below 5.2605 is affected.

Microsoft Outlook for iOS:

Version 1.0.0 and below 5.2605 is affected.

Microsoft Outlook for Mac:

Version 1.0.0 and below 5.2605 is affected.

Microsoft PowerBI for Android:

Version 2.0.0 and below 2.2.260210.21290750 is affected.

Microsoft PowerBI for iOS:

Version 1.0.0 and below 1.2.260302.2193910 is affected.

Microsoft PowerPoint for Android:

Version 16.0.0.0 and below 16.0.19822.20038 is affected.

Microsoft PowerPoint for iOS:

Version 1.0 and below 2.106.26020617 is affected.

Microsoft Teams for Android:

Version 1.0.0 and below 1.0.0.2026043102 is affected.

Microsoft Teams for iOS:

Version 2.0.0 and below 8.3.1 is affected.

Microsoft Word for Android:

Version 16.0.0.0 and below 16.0.19822.20038 is affected.

Microsoft Word for iOS:

Version 2.0.0 and below 2.106.26020617 is affected.

Exploit Probability

EPSS

0.06%

Percentile

18.14%