cve-2026-42824

CVE-2026-42824, also known as SearchLeak, is a patched Microsoft 365 Copilot Enterprise vulnerability disclosed by Varonis Threat Labs in June 2026. The flaw allowed an attacker to exfiltrate emails, MFA codes, calendar data, SharePoint files, OneDrive documents, and other indexed organizational content after a victim clicked a crafted Microsoft 365 search link. Microsoft remediated the vulnerability server-side. The attack chain abused Copilot Search, browser rendering, and Microsoft service trust to leak data without requiring malware or OAuth consent. This vulnerability highlights the risks of enterprise AI assistants with broad access to corporate data, emphasizing the need for administrators to rethink security boundaries around AI-powered search and data access.