Back Feeds.4Sysops

Microsoft patches critical SearchLeak vulnerability in Copilot for Microsoft 365

Feeds.4Sysops •IT News • June 16, 2026

Microsoft recently addressed a maximum severity vulnerability in Copilot for Microsoft 365 identified as CVE-2026-42824. The flaw, dubbed SearchLeak, allowed attackers to exfiltrate sensitive data through a single-click exploit involving a specially crafted URL. This vulnerability highlights the ongoing difficulty AI models face in distinguishing between legitimate user instructions and malicious prompts embedded in third-party content. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SearchLeak Vulnerability in Microsoft 365 Copilot Exposes Sensitive Data A newly disclosed vulnerability in Microsoft 365 Copilot Enterprise, named SearchLeak (CVE-2026-42824), allows attackers to exfiltrate sensitive data with a single click on a crafted link. Discovered by Varonis Threat Labs, the attack exploits a chain of three vulnerabilities: parameter-to-prompt injection, an HTML rendering race condition, and a server-side request forgery (SSRF) via Bing. The attack targets emails, calendar entries, and files stored in OneDrive and SharePoint, enabling the theft of sensitive information such as MFA codes and access tokens. Microsoft rated the vulnerability as critical and patched it on June 4, 2026, requiring no action from users. The flaw is particularly dangerous as it bypasses traditional security measures due to the use of a legitimate Microsoft domain. No evidence of in-the-wild exploitation has been reported. 25 sources 71

Extracted Entities

Microsoft patches critical SearchLeak vulnerability in Copilot for Microsoft 365

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)

Vulnerabilities (1)