This vulnerability (CVE-2026-26133) in Microsoft 365 Copilot for Android involves improper neutralization of special elements in commands, enabling command injection (CWE-77). An attacker can exploit this flaw to disclose sensitive information over a network without privileges, requiring only user interaction. The vulnerability affects version 1.0 of the product. Microsoft manages remediation for this cloud service and has issued an official fix. No known exploits are reported in the wild as of the publication date.

Successful exploitation can lead to unauthorized information disclosure over a network. The vulnerability does not impact integrity or availability but compromises confidentiality. The attack vector is network-based with low attack complexity and no privileges required, though user interaction is necessary.

Microsoft has released an official fix for this vulnerability. Since Microsoft 365 Copilot for Android is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should ensure their service is updated according to Microsoft's guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26133.