Skip to content
OpenAdvisories
High MSRC-CVE-2026-26133 1 CVE

M365 Copilot Information Disclosure Vulnerability

Published Mar 12, 2026 · Updated Apr 9, 2026 · Revision 3

Summary

Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, the attack vector is network (AV:N) and user interaction is required (UI:R). Why does the CVE title indicate that this is information disclosure?
An attacker who successfully exploited this vulnerability could use malicious email to cause Copilot to present authoritative‑looking phishing messages that prompt the user to click links leading to data exfiltration or navigation to a malicious site.

According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of confidentiality (C:H), and some loss of integrity (I:L), but no loss of availability (A:N). What does that mean for this vulnerability?
An attacker who successfully exploited this vulnerability could potentially view sensitive information (confidentiality) or make limited changes to disclosed information (integrity); however, it is unlikely that both would be impacted simultaneously, and the attacker would not be able to affect availability.

Security updates
2.106.26020617 — https://apps.apple.com/us/app/microsoft-onenote/id410395246?platform=mac
5.2605 — https://go.microsoft.com/fwlink/p/?linkid=831049
5.2605 — https://learn.microsoft.com/en-us/officeupdates/release-notes-outlook-mobile
2.107.2 — https://apps.apple.com/us/app/microsoft-365-copilot/id541164041
145.3800.99 — https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security
8.3.1 — https://apps.apple.com/us/app/microsoft-teams/id1113153706
1.0.0.2026043102 — https://play.google.com/store/apps/details?id=com.microsoft.teams
16.0.19822.20038 — https://play.google.com/store/apps/details?id=com.microsoft.office.excel&hl=en_US
16.0.19822.20038 — https://play.google.com/store/apps/details?id=com.microsoft.office.word&hl=en_US
2.106.26020617 — https://apps.apple.com/us/app/microsoft-powerpoint/id586449534?platform=mac
2.106.26020617 — https://apps.apple.com/us/app/microsoft-word/id462054704?mt=12
2.106.26020617 — https://apps.apple.com/us/app/microsoft-loop/id1637682491
5.2605 — https://apps.apple.com/ca/app/microsoft-outlook/id951937596
16.0.19815.10000 — https://play.google.com/store/search?q=copilot+365&c=apps
2.2.260210.21290750 — https://play.google.com/store/search?q=powerbi&c=apps
1.2.260302.2193910 — https://apps.apple.com/us/app/microsoft-power-bi/id929738808
16.0.19725.20142 — https://play.google.com/store/apps/details?id=com.microsoft.office.onenote
16.0.19822.20038 — https://play.google.com/store/apps/details?id=com.microsoft.office.powerpoint&hl=en_US
2.106.26020617 — https://apps.apple.com/us/app/microsoft-excel/id586683407?platform=mac

Vulnerabilities 1

Revision history

  1. #3

    Updated CWE value. This is an informational change only.

  2. #1

    Information published.

  3. #2

    Updated an acknowledgement. This is an informational change only.

References