CVE-2026-26133
Published: 16 March 2026
Summary
CVE-2026-26133 is a high-severity Command Injection (CWE-77) vulnerability in Microsoft Outlook. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Enterprise AI Assistants; in the LLM/Generative AI Risks risk domain.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2026-26133 is an AI command injection vulnerability (CWE-77) affecting Microsoft 365 Copilot. Published on 2026-03-16, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N), indicating a high-severity issue that enables an unauthorized attacker to disclose information over a network.
The vulnerability can be exploited by an unauthorized attacker with network access, requiring low attack complexity and no privileges, though user interaction is necessary. Successful exploitation allows the attacker to achieve high confidentiality impact through information disclosure and low integrity impact, potentially compromising sensitive data within the M365 Copilot environment.
Mitigation details are provided in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26133.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12111
Vulnerability details
AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Enterprise AI Assistants
- Risk Domain
- LLM/Generative AI Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: ai, m365 copilot
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote command injection (CWE-77) in public-facing M365 Copilot service directly enables T1190 exploitation over the network with no privileges and T1059.009 via unauthorized cloud API/command execution for data disclosure.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly blocks CWE-77 command injection by validating all inputs to M365 Copilot before AI processing.
Filters Copilot outputs to stop unauthorized high-confidentiality information disclosure after injection.
Enforces information flow policies that limit what data the AI can retrieve or return over the network.