Critical Microsoft 365 Copilot Vulnerabilities Expose sensitive Information

Cybersecuritynews •Guru Baran • May 9, 2026

Microsoft has disclosed and fully remediated three critical information disclosure vulnerabilities affecting Microsoft 365 Copilot and Copilot Chat in Microsoft Edge, all released on May 7, 2026, requiring no action from end users or administrators. Microsoft’s Security Response Center published advisories for CVE-2026-26129, CVE-2026-26164, and CVE-2026-33111 as part of its ongoing commitment to transparency in […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft 365 Copilot Vulnerabilities Expose Sensitive Information On May 7, 2026, Microsoft disclosed and remediated three critical information disclosure vulnerabilities in Microsoft 365 Copilot and Copilot Chat, tracked as CVE-2026-26129, CVE-2026-26164, and CVE-2026-33111. These vulnerabilities allowed unauthorized access to sensitive information, requiring no action from end users or administrators for remediation. The issues were identified in Microsoft Edge and highlighted risks associated with enterprise AI assistants accessing confidential emails and documents. An earlier defect, first detected on January 21, 2026, allowed Copilot to summarize confidential emails despite sensitivity labels, prompting Microsoft to implement a fix in early February. The recurring data-exposure risks in Copilot deployments raise compliance concerns for organizations using these tools. Microsoft has committed to transparency in addressing these vulnerabilities. 3 sources 69

Extracted Entities

Critical Microsoft 365 Copilot Vulnerabilities Expose sensitive Information

The full story

Extracted Entities

Attack Types (1)

CVEs (3)

CWE Weaknesses (1)

Platforms (1)