Back Scworld

SearchLeak vulnerability allows data theft from Microsoft 365 Copilot Enterprise

Scworld • June 15, 2026

Bleeping Computer reports that a critical vulnerability chain dubbed SearchLeak in Microsoft 365 Copilot Enterprise could allow attackers to steal sensitive data from a target's mailbox, OneDrive, or SharePoint account through a specially crafted URL.

The SearchLeak vulnerability, identified as CVE-2026-42824, is a three-stage attack chain developed by Varonis researchers. It combines a parameter-to-prompt injection, an HTML rendering race condition, and a content-security-policy bypass enabled by Bing server-side request forgery (SSRF). The attack begins when a victim clicks a malicious URL. This URL instructs Copilot to for specific data, such as email content or document titles. During the response streaming, an HTML rendering race condition allows an attacker-controlled image tag to execute, embedding the exfiltrated data within an image URL. This URL is then sent to Bing's " by Image" feature, which bypasses CSP protections and fetches the data from the attacker's endpoint. The stolen information is then visible in the attacker's server logs.

Microsoft has addressed this critical vulnerability, and no user action is required for mitigation.

Source: Bleeping Computer

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SearchLeak Vulnerability in Microsoft 365 Copilot Exposes Sensitive Data A newly disclosed vulnerability in Microsoft 365 Copilot Enterprise, named SearchLeak (CVE-2026-42824), allows attackers to exfiltrate sensitive data with a single click on a crafted link. Discovered by Varonis Threat Labs, the attack exploits a chain of three vulnerabilities: parameter-to-prompt injection, an HTML rendering race condition, and a server-side request forgery (SSRF) via Bing. The attack targets emails, calendar entries, and files stored in OneDrive and SharePoint, enabling the theft of sensitive information such as MFA codes and access tokens. Microsoft rated the vulnerability as critical and patched it on June 4, 2026, requiring no action from users. The flaw is particularly dangerous as it bypasses traditional security measures due to the use of a legitimate Microsoft domain. No evidence of in-the-wild exploitation has been reported. 34 sources 71

Extracted Entities

SearchLeak vulnerability allows data theft from Microsoft 365 Copilot Enterprise

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (2)

MITRE ATT&CK (1)

Platforms (1)

Vulnerabilities (1)