New attack turned Microsoft 365 Copilot into 1-click data theft tool
Source Bleeping Computer
Mentioned vulnerabilities
Rated by Threat Radar
Data as of 16 Jun 2026, 09:30 UTC
What to do
AI-suggested
Microsoft has released an official fix for CVE-2026-42824 addressing the SearchLeak vulnerability. No user action is required to mitigate this threat as the patch has been applied by Microsoft. Organizations should verify that their Microsoft 365 Copilot Enterprise environment is updated according to Microsoft's guidance.
Description
A critical vulnerability chain named SearchLeak in Microsoft 365 Copilot Enterprise allows attackers to steal sensitive data from a victim's mailbox, OneDrive, or SharePoint by tricking the user into clicking a specially crafted URL. The attack exploits a combination of a parameter-to-prompt injection, an HTML rendering race condition, and a server-side request forgery (SSRF) in Bing's image search feature to exfiltrate data without user awareness. Microsoft has addressed this vulnerability with an official fix, and no user action is required to mitigate the threat.