CVE-2026-58617

HighCVSS 8.1

Published: 14/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 17/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.79%

56th percentile - higher than 56% of all known CVEs

Summary

An improper access control vulnerability in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network.

Risk Assessment

An attacker could gain unauthorized access to sensitive data or application functions, posing a risk to the confidentiality and integrity of organizational information.

Recommendation

It is recommended to immediately apply the security update provided by Microsoft for Microsoft 365 Copilot on iOS and monitor the network for suspicious activity.

Other vulnerabilities in Microsoft 365 Copilot

CVE-2026-78501High
Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.

Original NVD description (English source)

Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS