Microsoft’s Security Update Guide has an entry for the identifier, and NIST’s National Vulnerability Database lists a publication date of August 28, 2026. These records establish a publicly tracked vulnerability, rather than evidence of an observed attack campaign.
What the race condition means
Rapid7 describes the underlying weakness as “Concurrent Execution using Shared Resource with Improper Synchronization.” A race condition occurs when operations access shared state without sufficient coordination, allowing their timing or order to affect the outcome. In this case, the recorded security consequence is information disclosure through Copilot Chat in Edge.
“Over a network” describes the attack path; it does not establish that an attacker can passively intercept all Copilot traffic. Likewise, “authorized attacker” indicates an access prerequisite, but the available description does not specify the account, permission, or session needed. Those boundaries are important when assessing exposure: this description alone does not establish a vulnerability across other Microsoft Copilot products.
What administrators can establish
The available advisory details do not establish a dependable affected-version range or a confirmed fixed Edge build. Consequently, there is no sufficiently supported version threshold here for declaring a device vulnerable or remediated.
For vulnerability-management teams, the useful distinction is between identifying the issue and verifying its resolution. CVE-2026-58616 supplies a specific tracking identifier and a named component—Copilot Chat in Edge—but a remediation decision still needs a verified Microsoft product-and-version mapping. A generic statement that Edge is “up to date” should not substitute for that mapping when closing this particular finding.