Microsoft Outlook for iOS Tampering Vulnerability

Summary

Vulnerabilities 1

• High 7.4
  CVE-2026-42893

  Microsoft Outlook for iOS Tampering Vulnerability

  Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to perform tampering over a network.

  Microsoft Microsoft Outlook for iOS iOS
  May 12, 2026

Revision history

1. 2026-05-12 #1

   Information published.

References

• CVE-2026-42893 Microsoft Outlook for iOS Tampering Vulnerability - HTML
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42893
• Microsoft Exploitability Index
  https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
• Microsoft Support Lifecycle
  https://support.microsoft.com/lifecycle
• Common Vulnerability Scoring System
  https://www.first.org/cvss