cve-2026-42824

On June 15, 2026, Varonis Threat Labs disclosed SearchLeak, a patched Microsoft 365 Copilot Enterprise vulnerability chain that could let an attacker steal emails, MFA codes, calendar data, SharePoint files, OneDrive documents, and other indexed organizational content after a victim clicked a...

Microsoft remediated CVE-2026-42824, a critical Microsoft 365 Copilot Enterprise vulnerability disclosed by Varonis Threat Labs on June 15, 2026, after researchers showed that a crafted Microsoft 365 search link could exfiltrate emails, MFA codes, calendar data, and indexed files with one click...

On June 15, 2026, Varonis Threat Labs disclosed SearchLeak, a now-patched Microsoft 365 Copilot Enterprise vulnerability chain tracked as CVE-2026-42824 that could let an attacker steal emails, MFA codes, calendar details, and files after one click on a Microsoft-hosted link. The bug is fixed...

Microsoft fixed CVE-2026-42824, a Microsoft 365 Copilot information-disclosure flaw known as SearchLeak, in early June 2026 after Varonis researchers showed that a malicious link could make Copilot Enterprise Search retrieve and leak work data. For Ghanaian office workers, the immediate message...

Microsoft disclosed and patched CVE-2026-42824 in June 2026 after Varonis Threat Labs showed that Microsoft 365 Copilot Enterprise Search could be abused through a one-click SearchLeak attack to extract user-accessible Microsoft 365 data through Bing-hosted request paths. The employee did not...

Microsoft fixed CVE-2026-42824, a Microsoft 365 Copilot information-disclosure vulnerability disclosed in June 2026, after Varonis researchers described a one-click “SearchLeak” attack chain that abused Copilot Search, browser rendering behavior, and Microsoft service trust to leak enterprise...

Microsoft has listed CVE-2026-42824 as an M365 Copilot information disclosure vulnerability in the Security Update Guide, describing a flaw whose practical risk turns less on code execution than on whether Copilot can be induced to expose data it should not reveal. That phrasing matters because...