CVE-2026-58617 is a high severity flaw (CVSS 8.1) in Microsoft 365 Copilot for iOS. Improper access control lets an unauthorized attacker elevate privileges over a network, with user interaction required. Update the app and check the MSRC guide for the fixed version.
What's affected
- Microsoft 365 Copilot for iOS.
- Fixed version: not stated in the record. The MSRC guide has it.
How to check if you're exposed
Open the App Store, search for Microsoft 365 Copilot, and check whether an update is pending. For managed devices, check the app version in your mobile device management tool against the MSRC guide.
Client software like this is tracked by your endpoint tools, not by a code scan, but the Gold directory is a quick way to look up the CVE record and its weakness class when you write the change ticket.
What to do now
- Update the app on managed and personal iOS devices.
- Use your MDM to report which devices still run an older build.
- Read the MSRC guide for any extra steps.
After updating, confirm the new build on a sample of devices and then look for stragglers in your management console. Devices that were offline or switched off during the rollout tend to be the last ones patched.
Why it matters
This is CWE-284 (Improper Access Control). Access checks do not fully limit what a caller can do. The record gives little detail, so this post does not guess at the mechanism.
The CISA KEV flag is false.
Mobile apps update through the store, so the cheapest control is to require automatic updates on managed devices and to report on the oldest installed version.
Quick check
Is it a server side fix?
The record lists the iOS app as the product. Check the MSRC guide for whether a service side fix also applies.
Sources
Last reviewed: 19 October 2026.
