M365 Copilot Flaw 'SearchLeak' Could Steal Secrets in One Click

Varonis Threat Labs reported a vulnerability chain dubbed "SearchLeak" (CVE-2026-42824) in Microsoft 365 Copilot Enterprise Search that could let attackers steal corporate secrets by tricking a victim into a single click on a malicious URL. Microsoft fixed the issue server-side in early June 2026, and no real-world exploitation has been observed.