CVE-2026-42893: Microsoft Outlook for iOS Tampering Vulnerability
Published May 12, 2026
·Updated
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to perform tampering over a network.
Other sources
Microsoft Outlook for iOS Tampering Vulnerability
— Microsoft
Affected Software
2 affected componentsFixes available
Microsoft Outlook for iOS
Microsoft Outlook Iphone Os<5.2617.1
Event History
May 12, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·02:00 PM
Affected Software
Updated
via Microsoft·02:00 PM
Description
CVE Published
via MITRE·04:59 PM
Data Sourced
via MITRE·04:59 PM
DescriptionSeverity
Data Sourced
via NVD·06:17 PM
DescriptionSeverityWeaknessAffected Software
Sep 11, 58334
Event
via NVD·12:26 AM
Frequently Asked Questions
1
What is the severity of CVE-2026-42893?
CVE-2026-42893 is classified as a critical vulnerability due to its potential for unauthorized command injection.
2
How do I fix CVE-2026-42893?
To fix CVE-2026-42893, update Microsoft Outlook for iOS to the latest version available in the app store.
3
Which versions of Outlook for iOS are affected by CVE-2026-42893?
CVE-2026-42893 affects Microsoft Outlook for iOS versions prior to 5.2617.1.
4
What does CVE-2026-42893 allow an attacker to do?
CVE-2026-42893 allows an attacker to perform tampering over a network through command injection.
5
Is there a patch available for CVE-2026-42893?
Yes, a patch is available and can be applied by updating Microsoft Outlook for iOS.