Breaking

Microsoft Patches Critical CVE-2026-42824 After 1-Click Data Theft Flaw Found in M365 Copilot Enterprise

June 15, 2026 at 09:03 EDT

Security
AI Agents
Sales & Business

Researchers at Varonis Threat Labs uncovered "SearchLeak," a flaw in Microsoft 365 Copilot Enterprise that lets attackers steal a victim's emails and files by getting them to click a single crafted URL, prompting Microsoft to assign CVE-2026-42824 (rated Critical) and issue a server-side fix in early June 2026.

June 2026 · Varonis Threat Labs

"SearchLeak": One Click Turned Microsoft 365 Copilot Into a Data-Theft Tool

A vulnerability chain (CVE-2026-42824, Critical) let an attacker exfiltrate mailbox, OneDrive and SharePoint data after a single click on a crafted URL. Microsoft patched it server-side — no user action required.

click on a crafted URL is all the attack requires

stages chained together to bypass defenses

exploitations reported in the wild

The attack chain — three stages to exfiltration

STAGE 1

P2P Injection

Malicious instructions reach Copilot Search via the URL "q" parameter.

→

STAGE 2

Render Race

A streaming race condition momentarily renders raw HTML.

→

STAGE 3

SSRF Bypass

Abusing Bing Search-by-Image defeats the CSP; data leaves via an <img> URL.

On screen: Copilot simply appears to be "thinking" — no visible sign of compromise.

A continuum of Copilot prompt-injection flaws

EchoLeak 2025 zero-click

Reprompt Jan 2026 one-click · Personal

SearchLeak 2026 one-click · Enterprise

Data at risk

Access codes & passwords in email bodies
Calendar events & meeting details
OneDrive & SharePoint documents

Enterprise Copilot's broad RAG access to corporate data became the exfiltration path itself.

Welcomed

Fixed entirely on the vendor side in early June 2026 — completed without any user action.

Concern

These "LLM Scope Violation" techniques could spread — renewing scrutiny over how AI agents' data-access rights are governed.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.