Summary
Impact: Tampering. Microsoft rating: Moderate. Not known to be exploited. Customer action: Required.
Details
How do I protect myself from this vulnerability?
Customers can help protect themselves by enabling Outlook's external sender tagging feature to identify untrusted content. This enables Microsoft's provided mitigations to isolate and safely process the untrusted content before it is provided to Microsoft 365 Copilot. Administrators can enable external sender tagging through Exchange Online PowerShell. Refer to the Microsoft Learn documentation for setup instructions and requirements.
Install the Exchange Online PowerShell Module, Connect to Exchange Online PowerShell, Set-ExternalInOutlook
Vulnerabilities 1
-
Medium 6.3
Outlook Copilot Tampering Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Outlook Copilot allows an authorized attacker to perform tampering over a network.
Revision history
-
#1
Information published.
References
-
CVE-2026-55145 Outlook Copilot Tampering Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55145
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss