Microsoft disclosed CVE-2026-26129 on May 7, 2026, as a critical information disclosure vulnerability in Microsoft 365 Copilot’s Business Chat, saying an unauthorized network attacker could exploit improper neutralization of special elements to disclose information, with no customer action...