Microsoft’s March Patch Tuesday pulled back a small, alarming corner of how modern productivity suites and agentic AI can interact — a cross‑site scripting flaw in Microsoft Excel that, when combined with the new Copilot Agent behavior, can be turned into a true zero‑click data‑exfiltration vector targeting whichever workbooks a user has open. (pcper.com) (msrc.microsoft.com)
The March 2026 Patch Tuesday rollout included fixes for dozens of Office and Windows vulnerabilities; among them Microsoft tracked an Excel information‑disclosure issue as CVE‑2026‑26144. Microsoft’s advisory describes the root cause as improper neutralization of input during web page generation — the textbook definition of a cross‑site scripting (CWE‑79) problem — but the wrinkle that has security teams on edge is that, in some configurations, the bug can be chained to the agentic features of Microsoft 365 Copilot so that Excel can be made to send data over the network without prompting or consent. (msrc.microsoft.com)
Independent reporting and early analysis flagged this as an especially worrisome combination: a long‑standing web class of bug (XSS) married to a modern, autonomous Copilot Agent workflow that can access open documents, query organizational services, and — crucially — initiate network egress. That intersection turns what would otherwise be a contained information disclosuriltration* mechanism.
(Note: community discussion and quick analysis of this Patch Tuesday cluster are aggregated in internal forum digests and reports inside our community files. These highlight the same CVE number and summarize the practical risk to Copilot‑enabled environments. )
The immediate, practical steps every security team should take are clear: patch urgently, restrict Copilot Agent until patched if feasible, lock down outbound Office egress, and enable DLP/EDR/sandbox detection that centers network traffic from Office processes. These are the controls that will blunt an attacker’s ability to convert a spreadsheet into a leak channel.
This incident is not just a technical footnote — it’s a governance warning. Agentic AI features should be treated like any other system privilege: they need explicit, auditable controls, least privileged access, and robust logging. Organizations that combine convenience and lax governance will continue to find themselves at the intersection where legacy web bugs meet modern AI automation — and where benign spreadsheets can become a covert exfiltration pipeline.
In short: treat this as urgent. Patch CVE‑2026‑26144 now, assume your Copilot‑enabled endpoints are sensitive by default, and implement outbound restrictions and DLP monitoring as first‑line compensating controls while you validate your environment. The vulnerability’s potency comes from the marriage of an old bug class with a new class of autonomous assistant — and defending against it requires both classic patch discipline and a new, agent‑aware security posture. (msrc.microsoft.com)
Source: PC Perspective Leveraging Copilot In Excel To Steal Data Without Any User Interaction - PC Perspective
Background / Overview
The March 2026 Patch Tuesday rollout included fixes for dozens of Office and Windows vulnerabilities; among them Microsoft tracked an Excel information‑disclosure issue as CVE‑2026‑26144. Microsoft’s advisory describes the root cause as improper neutralization of input during web page generation — the textbook definition of a cross‑site scripting (CWE‑79) problem — but the wrinkle that has security teams on edge is that, in some configurations, the bug can be chained to the agentic features of Microsoft 365 Copilot so that Excel can be made to send data over the network without prompting or consent. (msrc.microsoft.com)Independent reporting and early analysis flagged this as an especially worrisome combination: a long‑standing web class of bug (XSS) married to a modern, autonomous Copilot Agent workflow that can access open documents, query organizational services, and — crucially — initiate network egress. That intersection turns what would otherwise be a contained information disclosuriltration* mechanism.
(Note: community discussion and quick analysis of this Patch Tuesday cluster are aggregated in internal forum digests and reports inside our community files. These highlight the same CVE number and summarize the practical risk to Copilot‑enabled environments. )
What precisely is CVE‑2026‑26144?
The technical core
- The vulnerability is classified as an information disclosure (CWE‑79 / XSS) in Microsoft Excel’s web‑page generation/preview surface. In short, untrusted input can reach HTML/JavaScript contexts without being neutralized, allowing an attacker to inject script that executes in the context of an affected Excel preview/web frame. (msrc.microsoft.com)
- Microsoft’s published summary explicitly calls out that the flaw can be used to “cause Copilot Agent mode to exfiltrate data via unintended network egress,” which moves this from a theoretical XSS to a practical data‑theft risk whenever Copilot Agent is active. (msrc.microsoft.com)
Attack prerequisites and scope
- Exploitation requires the vulnerable Excel instance to process the malicious content. Several analysts point out likely vectors include preview panes, shared workbook previews, or web‑rendered content delivered through collaboration surfaces such as SharePoint, Teams, or third‑party integrations. An adversary could deliver the malicious payload as part of a file or a crafted link that renders HTML/JS in the Office preview context. (pcper.com)
- Microsoft’s advisory and vendor trackers list network access as required for exploitation, but they make clear no user interaction is necessary once the content is rendered — hence “zero‑click” or “zero‑interaction” in many headlines. That is, the victim need not type, click anything, or accept prompts beyond the ordinary rendering of the preview or workbook. (msrc.microsoft.com)
What Copilot Agent does that matters
- Copilot Agent (also described in Microsoft release notes as agentic or “agent” mode) can perform background actions on behalf of users: analyze sheets, query connected content (OneDrive, SharePoint, Outlook via Microsoft Graph), and prepare outputs or actions without a synchronous chat prompt. That autonomy—which is a productivity feature—also gives an attacker an automated actor to abuse: injected script can cause the agent to read worksheet contents and move them or send them to an attacker‑controlled endpoint. (pcper.com)
How the exploit chain is described (what we know and what we don’t)
Security reporting and vendor summaries have sketched plausible exploit chains but, crucially, a full public technical proof‑of‑concept (PoC) with step‑by‑step payloads has not been widely published by Microsoft. That means specific details about exactly how an attacker triggers Copilot to save or transmit a worksheet are still being reasonably inferred from Microsoft’s advisory text, researcher commentary, and observed agent capabilities.- Reported chain (high level): supply malicious HTML/JS to Excel’s web/render surface → injected script executes in Excel’s preview context → script instructs Copilot Agent or leverages agent APIs/behaviors to access workbook contents → data is sent to an external receiver via a network request created by the agent or by the injected script. (pcper.com)
- Where the public narrative diverges: researchers and reporters differ on whether the active egress is initiated by the agent itself (via its sanctioned network calls) or by the injected script taking advantage of embedded browser/network stacks that Excel exposes. Both outcomes are functionally identical for defenders — sensitive sheets leave the environment — but the exact mechanics matter for detection strategies and mitigations. At present those specifics are not comprehensively documented in a single public technical advisory. Treat any claim of an exact chain as tentative until a formal Microsoft technical write‑up or researcher PoC is available. (msrc.microsoft.com)
Why this matters: practical risk and likely targets
Excel remains one of the most common containers for high‑value corporate content: budgets, contracts, customer lists, inventory schedules, pricing models, and even hard credentials when users mismanage secrets. Turning a spreadsheet into a zero‑click exfiltration conduit changes a ubiquitous productivity artefact into an active reconnaissance and theft tool.- Enterprise risk: Organizations that have deployed Copilot widely and allowed agent modes broad access to files and Microsoft Graph will be most exposed. The adversary model is attractive: send a seemingly innocuous file or a link through a collaboration channel and gain access to whatever Excel instances render it — with no further social engineering required.
- Sensitive verticals: legal, finance, R&D, and government sectors — any place spreadsheets carry IP, PII, or regulatory information — should treat this as high‑priority. Security vendors and incident responders have emphasized restricting outbound Office network egress and monitoring Excel processes for unusual connections as pragmatic first steps.
Realistic delivery scenarios
Attackers prefer the path of least resistance. Below are the most plausible real‑world ways this kind of XSS→agent chain could be delivered:- Malicious file shared via SharePoint or OneDrive where the preview page renders attacker‑controlled HTML/JS and triggers the flaw.
- A crafted deep link or Teams message that navigates a target to a page that preloads a problematic preview or file.
- A compromised internal site used for file collaboration where an attacker plants a malicious workbook or HTML wrapper that will render the injected content when previewed.
- Spoofed vendor/supplier attachments in email where the Outlook preview or other Office preview surface renders the injected content without the user “opening” the full file. (pcper.com)
Mitigation: what security teams should do immediately
When a vulnerability is potentially able to convert a document preview into an exfiltration channel, the defensive posture should be immediate and layered.- Patch now — apply Microsoft’s March 2026 Office updates that address CVE‑2026‑26144 across affected Excel builds. Patching is the primary fix. Microsoft’s advisory and update guide are the authoritative starting point for mitigation and fixed versions. (msrc.microsoft.com)
- Until patched: apply policy controls:
- Disable or restrict Copilot Agent on endpoints that handle high‑value content. If your organization can’t patch immediately, remove the agent’s capability to execute background network actions or set policies that limit its permissions. Microsoft and multiple vendors recommend disabling agent modes as an interim control.
- Restrict outbound network egress from Office applications at the network or endpoint level (allowlist necessary Microsoft services only). This prevents quiet outbound connections that would carry exfiltrated data.
- Disable file preview panes where feasible, or configure browsers/clients to render previews in a hardened sandbox that strips active content. Preview panes shorten the attack chain for many Office RCE and info‑disclosure bugs.
- Deploy detections:
- Monitor for anomalous network behavior from Excel processes: unexpected connections to unfamiliar external IPs, HTTP POSTs containing large payloads, or Excel spawning network‑capable sub‑processes. Create SIEM alerts for Excel process egress.
- Check DLP telemetry and proxy logs for data flows originating from Office endpoints to suspicious endpoints. Data loss prevention signatures should be expanded to look for structured spreadsheets occurring outside expected destinations (e.g., to domains not authorized for data uploads).
- Harden collaboration surfaces:
- Review SharePoint and Teams sharing policies: disable anonymous or guest upload links if not strictly required; limit who can create pages or agent links; require content scanning for file uploads. (pcper.com)
- Communicate to user population:
- Treat this as a high‑priority advisory: inform users not to open or preview files from unknown sources and to report suspicious Teams/SharePoint links. This is a temporary behavioral control while technical mitigations are applied.
Detection & incident response guidance
If you suspect exploitation, treat it as a data‑exfiltration incident with potential broad exposure.- Immediately isolate endpoints that show anomalous Excel network activity and capture volatile memory and process lists to preserve evidence of agent behavior.
- Pull proxy and gateway logs to identify external destinations contacted by Excel processes; record timestamps, payload sizes, and any identifying HTTP headers.
- Search for new files or uploads with recent modification times created by Excel or Copilot agents; attackers will often save or stage spreadsheets before exfiltration.
- Use DLP tools to reconstruct what left the environment: column headers, worksheet names, or common values can help scope exposure even if the payload was transferred in chunks or obfuscated.
Broader context: agentic AI and legacy vulnerabilities
This Excel story is part of a broader pattern that security practitioners and researchers have warned about for more than a year: legacy classes of vulnerabilities (XSS, RCE, preview‑pane bugs) take on new potency when handed an autonomous or semi‑autonomous AI assistant that has privileged access to files and the ability to make outbound requests.- The category of “zero‑click” AI‑enabled exfiltration is not unique to Excel; earlier issues named EchoLeak and Reprompt showed that Copilot’s integration points (URLs that prefill prompts, document previews) could be abused to leak data with minimal user action. CVE‑2026‑26144 shows the same risk pattern applied to Excel’s web rendering. Security operations must therefore consider agentic behavior when modeling risk and threat detection.
- Product design tradeoffs are visible: convenience features like prefilled prompts, background agents that can “do the work for me,” and rich file previews speed productivity, but they increase the attack surface and require a different set of governance and technical guardrails than earlier generations of office software.
What Microsoft and vendors are advising (summary)
Security commentators and vendors converged on a set of practical guidance in the hours after the patch release:- Patch Office/Excel immediately. Microsoft’s update guide is the authoritative source for fixed versions. (msrc.microsoft.com)
- If you cannot patch immediately, restrict Copilot Agent and outbound network routes from Office clients. The Register quoted incident response and patching experts who recommended disabling Copilot until the update is applied.
- Increase monitoring and DLP enforcement, especially for Excel‑originated network traffic and unusual upload destinations. Security providers such as CrowdStrike and Action1 highlighted monitoring egress as a priority.
Short checklist for CISOs (step‑by‑step)
- Confirm inventory: identify all endpoints with Copilot Agent enabled or Excel variants that the organization uses.
- Prioritize patching for devices in finance, legal, R&D, and executive functions.
- Apply network allow‑lists for Office traffic; block unknown outbound destinations at the firewall and proxy for Excel/Office processes.
- Disable preview panes and agent modes for unpatched user populations.
- Roll out SIEM/EDR rules to alert on Excel process network connections to non‑Micpand DLP policies to include commonly sensitive Excel schema and watch for large/structured data uploads.
- Prepare an incident playbook entry for potential Excel/Copilot exfil events, including forensic collection for Excel process memory and network captures.
Strengths, limitations, and open questions
This vulnerability is striking because it demonstrates the systemic risk of pairing powerful automation with historically mundane document surfaces. However, a few important caveats:- The public documentation and reporting emphasize the possibility of exfiltration via Copilot Agent, but detailed exploit mechanics (proofs, exact script paths, or enumerated delivery HTML) have not been published in a single comprehensive technical disclosure at the time of this writing. That means defenders must act on a high‑confidence, conservative threat model rather than a verbatim exploit script. Treat any specific claim about “how Copilot saves worksheets to X” as provisional until vetted by Microsoft or independent researchers. (msrc.microsoft.com)
- Exploitation requires a delivery path that causes Excel to render the malicious payload. Organizations that already restrict preview functionality, isolate file rendering, or use hardened file scanners are at lower relative risk, but not immune—especially if internal collaboration sites or vendor portals are compromised.
- The CVSS and vendor tracking classify the issue as high/critical because of the potential confidentiality impact in Copilot environments; the practical impact depends heavily on organizational configuration, Copilot permissions, and network controls in place.
Final analysis and takeaways
CVE‑2026‑26144 is an early‑2026 inflection point: it shows that traditional web bug classes such as XSS retain relevance, and that the power of agents like Microsoft Copilot transforms those bugs into immediate enterprise‑grade data exfiltration threats. The fix path is straightforward in principle — patch and tighten Copilot permissions — but the operational reality is messy: many organizations have Copilot enabled broadly, collaboration surfaces that encourage easy file sharing, and limited telemetry to detect quiet exfiltration.The immediate, practical steps every security team should take are clear: patch urgently, restrict Copilot Agent until patched if feasible, lock down outbound Office egress, and enable DLP/EDR/sandbox detection that centers network traffic from Office processes. These are the controls that will blunt an attacker’s ability to convert a spreadsheet into a leak channel.
This incident is not just a technical footnote — it’s a governance warning. Agentic AI features should be treated like any other system privilege: they need explicit, auditable controls, least privileged access, and robust logging. Organizations that combine convenience and lax governance will continue to find themselves at the intersection where legacy web bugs meet modern AI automation — and where benign spreadsheets can become a covert exfiltration pipeline.
In short: treat this as urgent. Patch CVE‑2026‑26144 now, assume your Copilot‑enabled endpoints are sensitive by default, and implement outbound restrictions and DLP monitoring as first‑line compensating controls while you validate your environment. The vulnerability’s potency comes from the marriage of an old bug class with a new class of autonomous assistant — and defending against it requires both classic patch discipline and a new, agent‑aware security posture. (msrc.microsoft.com)
Source: PC Perspective Leveraging Copilot In Excel To Steal Data Without Any User Interaction - PC Perspective