ByteOS Network

CVE Vulnerability Details :

CVE-2026-41090

PUBLISHED

More Info Official Page

Assigner-microsoft

Assigner Org ID-f38d906d-7342-40ea-92c1-6c4a2c6478c8

Published At-22 May, 2026 | 22:03

Updated At-22 May, 2026 | 22:03

▼CVE Numbering Authority (CNA)

Microsoft Copilot Tampering Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.

Affected Products

Vendor

Microsoft Corporation

Product

Microsoft 365 Copilot for iOS

Versions

Affected

Problem Types

Type	CWE ID	Description
CWE	CWE-77	CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

Type: CWE

CWE ID: CWE-77

Description: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

Metrics

Version	Base score	Base severity	Vector
3.1	9.3	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C

Version: 3.1

Base score: 9.3

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C

References

Hyperlink	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41090	vendor-advisory patch

Hyperlink: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41090

Resource:

vendor-advisory

patch

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References