CVE-2026-41100
Full vulnerability record from the local CVENow database.
Description
Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally.
Severity
MEDIUM
CVSS score
4.4
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-05-12 18:17:21.507000
Last modified
2026-10-26 18:10:00.173000
View original CVE JSON
{
"id": "CVE-2026-41100",
"sourceIdentifier": "[email protected]",
"published": "2026-05-12T18:17:21.507",
"lastModified": "2026-10-26T18:10:00.173",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally."
},
{
"lang": "es",
"value": "Control de acceso inadecuado en M365 Copilot permite a un atacante autorizado realizar suplantación de identidad localmente."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Microsoft",
"product": "Microsoft 365 Copilot for Android",
"versions": [
{
"version": "1.0",
"lessThan": "16.0.19822.20190",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft Excel for Android",
"versions": [
{
"version": "16.0.0.0",
"lessThan": "16.0.19822.20190",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft Loop for Android",
"versions": [
{
"version": "1.0.0",
"lessThan": "16.0.19822.20190",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft OneNote for Android",
"versions": [
{
"version": "16.0.1",
"lessThan": "16.0.19822.20190",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft PowerPoint for Android",
"versions": [
{
"version": "16.0.0.0",
"lessThan": "16.0.19822.20190",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft Word for Android",
"versions": [
{
"version": "16.0.0.0",
"lessThan": "16.0.19822.20190",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.8,
"impactScore": 2.5
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-13T14:34:33.636278Z",
"id": "CVE-2026-41100",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-284"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:microsoft:365_copilot:*:*:*:*:*:android:*:*",
"versionEndExcluding": "16.0.19822.20190",
"matchCriteriaId": "71B289C6-6C8F-4217-AA2A-06931EE86372"
}
]
}
]
}
],
"references": [
{
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41100",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}