CVE-2026-41090: Microsoft 365 Copilot RCE Vulnerability

CVE-2026-41090 Overview

CVE-2026-41090 is a command injection vulnerability in Microsoft 365 Copilot. The flaw stems from improper neutralization of special elements used in a command [CWE-77]. An unauthorized attacker can exploit this issue over a network to perform tampering against affected Copilot sessions. Exploitation requires user interaction, and the scope changes when the attack succeeds. Microsoft published the advisory on May 22, 2026 through the Microsoft Security Response Center (MSRC).

Critical Impact

A successful attacker can inject crafted commands into Microsoft 365 Copilot, tampering with high-integrity content and exposing confidential data accessible to the targeted user.

Affected Products

• Microsoft 365 Copilot
• Microsoft 365 Copilot on iOS (per published CPE)
• Tenants integrating Copilot with Microsoft 365 services

Discovery Timeline

• 2026-05-22 - CVE-2026-41090 published to NVD
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-41090

Vulnerability Analysis

The vulnerability is a network-exploitable command injection affecting Microsoft 365 Copilot. The product fails to properly neutralize special elements before passing input into a command context. An attacker delivers crafted content that the Copilot assistant processes, causing the assistant to execute attacker-controlled instructions. Because the scope changes during exploitation, the impact extends beyond the originally vulnerable component to other resources in the user's session. The confidentiality and integrity impact is high, while availability is unaffected.

Root Cause

The root cause is improper input sanitization in Copilot's command processing path. Copilot ingests user content, external documents, and connected data sources as part of its prompt context. When special command elements are not neutralized, attacker-supplied content is interpreted as actionable instructions. This pattern aligns with [CWE-77] Improper Neutralization of Special Elements used in a Command. The flaw is consistent with prompt injection style attacks against large language model assistants that bridge into command execution paths.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker stages malicious content in a location that Copilot will retrieve, such as a shared document, email, calendar item, or third-party connector. When the target user invokes Copilot to summarize, draft, or act on that content, the injected commands execute in the user's authenticated context. The attacker does not need prior authentication to the target tenant. Successful exploitation enables tampering with stored data, modifying generated output, and exfiltrating information across scope boundaries.

No public proof-of-concept code is available. See the Microsoft Security Update CVE-2026-41090 advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-41090

Indicators of Compromise

• Copilot-generated content that contains unexpected commands, links, or instructions referencing external domains.
• Unusual Copilot activity logs showing access to mailboxes, SharePoint sites, or OneDrive items outside normal user behavior.
• Outbound requests from Copilot service interactions to attacker-controlled infrastructure shortly after user prompts.

Detection Strategies

• Review Microsoft 365 audit logs for anomalous Copilot interactions, including unexpected file access or message generation tied to specific shared documents.
• Correlate Copilot activity with inbound email and external file sharing events to identify documents that trigger anomalous assistant behavior.
• Apply Data Loss Prevention (DLP) policies that flag Copilot output containing sensitive data patterns sent to external recipients.

Monitoring Recommendations

• Enable Microsoft Purview audit logging for Copilot interactions and retain logs for forensic analysis.
• Monitor identity telemetry for session anomalies following Copilot use, including token reuse and unexpected resource access.
• Alert on Copilot prompts that reference external URLs, encoded payloads, or instruction-like text embedded in documents.

How to Mitigate CVE-2026-41090

Immediate Actions Required

• Apply the security update referenced in the Microsoft Security Update CVE-2026-41090 advisory across all affected Microsoft 365 Copilot deployments.
• Restrict Copilot access to untrusted external content sources, including third-party connectors and unmanaged shared documents.
• Educate users to verify Copilot-generated content before acting on links, commands, or sensitive data instructions.

Patch Information

Microsoft addressed CVE-2026-41090 through a service-side update. Customers do not need to install a client patch because Microsoft 365 Copilot is delivered as a cloud service. Confirm tenant remediation status through the Microsoft 365 admin center and the MSRC advisory.

Workarounds

• Limit Copilot exposure to content from external or untrusted senders by tightening Microsoft 365 sharing and external collaboration policies.
• Disable optional Copilot connectors that ingest data from external systems until the update is confirmed applied.
• Apply conditional access policies to require compliant devices and managed sessions before users can invoke Copilot.

# Example: restrict external sharing in SharePoint Online via PowerShell
Set-SPOTenant -SharingCapability ExternalUserSharingOnly
Set-SPOTenant -DefaultSharingLinkType Internal
Set-SPOTenant -PreventExternalUsersFromResharing $true