CVE-2026-26133
Published: 16 March 2026
Summary
CVE-2026-26133 is a high-severity Command Injection (CWE-77) vulnerability in Microsoft Outlook. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Enterprise AI Assistants.
Threat & Defense at a Glance
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote command injection (CWE-77) in public-facing M365 Copilot service directly enables T1190 exploitation over the network with no privileges and T1059.009 via unauthorized cloud API/command execution for data disclosure.
NVD Description
AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.
Deeper analysisAI
CVE-2026-26133 is an AI command injection vulnerability (CWE-77) affecting Microsoft 365 Copilot. Published on 2026-03-16, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N), indicating a high-severity issue that enables an unauthorized attacker to disclose information over a network.
The vulnerability can be exploited by an unauthorized attacker with network access, requiring low attack complexity and no privileges, though user interaction is necessary. Successful exploitation allows the attacker to achieve high confidentiality impact through information disclosure and low integrity impact, potentially compromising sensitive data within the M365 Copilot environment.
Mitigation details are provided in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26133.
Details
- CWE(s)
Affected Products
AI Security AnalysisAI
- AI Category
- Enterprise AI Assistants
- Risk Domain
- N/A
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: ai, copilot