This vulnerability, identified as CVE-2026-41090 and classified under CWE-77 (Improper Neutralization of Special Elements used in a Command), affects Microsoft 365 Copilot for iOS. It allows an attacker to inject malicious commands due to improper sanitization of input, enabling unauthorized tampering over a network. The CVSS 3.1 base score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality and integrity. The service is cloud-hosted, and Microsoft manages remediation server-side with an official fix available.

An attacker can exploit this vulnerability remotely without privileges to execute unauthorized commands, leading to high confidentiality and integrity impact. This could result in tampering with data or commands processed by Microsoft 365 Copilot for iOS. Availability impact is not affected. No known exploits are reported in the wild at this time.

Microsoft has released an official fix for this vulnerability and manages remediation for this cloud-hosted service. Users should ensure their Microsoft 365 Copilot for iOS service is updated according to Microsoft's guidance. Check the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41090 for the latest remediation details.