Loading vulnerability…
Cross-Prompt Injection Information Disclosure in Microsoft 365 Copilot Email Summarization
CVE-2026-26133 is an AI command injection and cross-prompt injection vulnerability in Microsoft 365 Copilot’s email summarization surfaces, including Outlook and Teams-integrated Copilot experiences. The flaw arises when Copilot processes untrusted email content and fails to reliably neutralize instruction-like text or maintain a strict boundary between attacker-controlled message content and the model’s operational instructions. As a result, text embedded in an otherwise ordinary email can be interpreted by the model as commands, allowing an attacker to influence the generated summary. Reported behavior included attacker-shaped phishing content appearing inside Copilot’s trusted summary interface and, in some scenarios, model-mediated retrieval of internal Microsoft 365 context such as collaboration data accessible through the user’s Copilot permissions. The issue is fundamentally a prompt-boundary and special-element neutralization failure in an LLM-assisted enterprise workflow.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause unauthorized disclosure of sensitive information over the network. The most significant reported impact is that attacker-controlled prompt content can steer Copilot to incorporate internal tenant data available through the victim user’s Microsoft 365 permissions into generated output, potentially facilitating exfiltration through attacker-directed links or other summary content. The vulnerability also enables highly credible model-mediated phishing by making malicious instructions appear as trusted Copilot-generated guidance, increasing the likelihood of user action. Integrity and availability impacts were not the primary reported concern; the core risk is confidentiality loss and user-assisted disclosure through trusted AI output.
If you can’t patch tonight, do this now.
Where immediate risk reduction is needed, restrict Copilot retrieval scope and permissions to minimize accessible cross-application data, particularly access to Teams, OneDrive, and SharePoint content not required for business use. Apply data protection controls such as Microsoft Purview sensitivity labels and DLP policies to reduce the impact of retrieval-based disclosure. Enable link protection controls such as Safe Links to subject links rendered through Copilot experiences to reputation and detonation checks. Train users that AI-generated summaries are not inherently trustworthy or system-authored and may contain attacker-influenced content. Monitor Copilot activity and retrieval patterns for anomalous cross-app access consistent with prompt-injection attempts.
Patch, then assume compromise.
Microsoft confirmed the issue and deployed server-side mitigations, with rollout reported complete by March 11, 2026, and public CVE publication on March 12, 2026. Organizations using Microsoft 365 Copilot should ensure the March 2026 fixes are fully applied across affected Copilot surfaces. Because the issue affects a cloud-hosted service, remediation primarily depends on Microsoft’s service-side patching rather than customer-managed binary updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.