Microsoft 365 Copilot Hit by 1-Click Data-Theft Flaw 'SearchLeak,' Now Patched

Varonis Threat Labs on June 15 disclosed SearchLeak, an attack that chains three vulnerabilities in Microsoft 365 Copilot Enterprise Search so that a single click on a trusted microsoft.com link can siphon a victim's emails, calendar data, files and one-time codes. Microsoft rated it CVE-2026-42824 as Critical (maximum severity) and has already deployed a server-side fix.