This vulnerability (CVE-2026-41090) in Microsoft 365 Copilot for iOS is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command). It allows remote attackers to inject commands due to insufficient sanitization of input, potentially enabling unauthorized tampering. The CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, scope changed, and high confidentiality and integrity impact. The product is a cloud service, and Microsoft manages remediation server-side with an official fix available as per the vendor advisory.

Successful exploitation could allow an attacker to execute unauthorized commands remotely, leading to tampering with data or system behavior. The confidentiality and integrity of the affected service could be severely compromised. Availability impact is not indicated. No known exploits are currently reported in the wild.

Microsoft has released an official fix for this vulnerability. As Microsoft 365 Copilot for iOS is a cloud service, the vendor manages remediation server-side. Users and administrators should ensure their service is updated according to Microsoft's guidance in the official advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41090. No additional user action is required beyond applying the official fix.