cve-2026-26129

CVE-2026-26129 is a critical information disclosure vulnerability in Microsoft 365 Copilot's Business Chat, disclosed by Microsoft on May 7, 2026. An unauthorized network attacker could exploit improper neutralization of special elements to disclose information. Microsoft has already mitigated the issue, requiring no customer action. The vulnerability raises concerns about Copilot's promise of using enterprise data without leaking it, highlighting a tension between reassurance and alarm in the advisory. This tag covers discussions about the disclosure, impact, and implications of CVE-2026-26129 for enterprise users of Microsoft 365 Copilot.