Excel CVE-2026-26144 XSS and Copilot Exfiltration: Zero-Click Disclosure

A critical Microsoft Excel flaw disclosed in the March 2026 Patch Tuesday has opened a new, unsettling vector for data theft: a cross‑site scripting (XSS) bug that can be weaponized to make Microsoft’s Copilot Agent silently exfiltrate information without any user interaction — a true zero‑click information disclosure scenario.

Background / Overview​

Microsoft’s March 10, 2026 security update bundle patched 80+ CVEs across Windows, Office, Azure, .NET and related components. Among the highest‑priority fixes is CVE‑2026‑26144, described by Microsoft and multiple industry trackers as an information disclosure vulnerability in Microsoft Excel tied to improper neutralization of input during web page generation (a classic CWE‑79 XSS). The practical consequence is straightforward and alarming: if exploited, Excel can be induced to cause the Copilot Agent integrated into Office applications to perform unintended network egress, sending out data that should have stayed local.
Security researchers and trackers flagged the scenario as particularly notable because it multiplies the attack surface of a memory‑ or input‑handling bug with an AI agent that is designed to act autonomously on behalf of users. Trend Micro’s Zero Day Initiative labeled the bug “fascinating” and warned the attack model — an AI agent coerced into leaking data — is one we can expect to see again.

---

What exactly is CVE‑2026‑26144?​

The technical core: XSS in Excel’s web page generation​

At the code level, CVE‑2026‑26144 stems from improper neutralization of input during web page generation inside Excel. That means user‑controlled content within a workbook can be turned into markup or script that Excel does not correctly sanitize before rendering or processing. In web security terms this is a classical cross‑site scripting (XSS) primitive — an attacker‑controlled payload embedded in content that then executes or is processed in an unintended execution context.
Unlike browser XSS that directly runs JavaScript in a web page, this Excel XSS is notable because the victim is an Office desktop or desktop‑equivalent environment and the payload can trigger another subsystem — Copilot Agent mode — to act on data extracted from the workbook. Microsoft’s advisory states the vulnerability can cause Copilot Agent to exfiltrate data via unintended network egress, creating a zero‑click information disclosure attack surface.

Exploit mechanics in plain language​

• An attacker crafts a malicious workbook that embeds specially formed input (text, HTML fragments, or content that Excel will convert to a web rendered form).
• When Excel processes the malicious content it fails to neutralize the input, enabling the embedded content to influence Excel’s handling of the workbook.
• This manipulated handling can cause Copilot Agent — the automated assistant that may process file contents to provide summaries, suggestions, or actions — to make network requests that disclose the target system’s data to an attacker‑controlled endpoint.
• Critically, Microsoft’s advisory indicates no user interaction is required to trigger the exfiltration once the workbook is processed, which is why researchers call it a zero‑click scenario.

---

Why this is more than an XSS curiosity: the AI agent multiplier​

XSS has been a familiar class of vulnerability for decades. What elevates CVE‑2026‑26144 from “just another XSS” to a major operational risk is the presence of an agentic AI component inside the product.

• Copilot Agent mode is designed to read, summarize, and act on document content automatically to boost productivity. When those automation paths are invoked without visible user action, they can be co‑opted by attackers to perform network operations that would be harder to trigger through typical user interaction models.
• The attacker is not merely running a script locally — they are coercing a component that legitimately has network privileges and the ability to fetch, send, or summarise content to act as their proxy for data exfiltration.
• Because the attack can occur without explicit user clicks and without privilege escalation (the agent runs in the context of the logged‑on user), classic indicators like suspicious process elevation or unusual file writes might not be present. That makes detection and containment harder.

This combination — a memory or input‑sanitisation bug plus an autonomous network‑capable assistant — represents a new pattern: vulnerabilities that weaponize AI features to extend an exploit’s reach. Security teams should treat these as different in kind, not merely more of the same.

---

How serious is the rating — Critical vs High?​

There’s a noteworthy labeling nuance to call out. Public trackers record CVSS v3.1 base score 7.5 for CVE‑2026‑26144, which maps to a High severity band under CVSS conventions. At the same time, several industry write‑ups described the bug as Critical because of its information‑disclosure impact when combined with Copilot Agent — i.e., the real‑world risk could be judged higher than the technical CVSS vector alone implies.
Why the difference matters:

• CVSS expresses attack vector, complexity, privileges, and impact on confidentiality/integrity/availability, but it does not capture emergent features such as agent orchestration or organizational sensitivity of the data likely to be processed by Copilot.
• Organizations should therefore triage based on exposure and impact, not just CVSS number. An Excel‑heavy environment with Copilot Agent enabled and sensitive spreadsheets automatically processed is materially more at risk than a standalone consumer machine with Copilot disabled.

---

Realistic attack scenarios and threat models​

Below are plausible threat models defenders must consider. Each assumes the attacker can deliver or place a crafted workbook into an environment where Excel will process it (via email attachments, shared network folders, collaboration platforms, or misconfigured file previews).

• Targeted exfiltration from a compromised inbox: Attackers send a malicious spreadsheet to a finance user; Outlook preview or a server processing job triggers Excel’s web page generation and Copilot Agent action, which then forwards selected cells or summaries to the attacker’s endpoint without the user ever clicking.
• Supply‑chain or shared repository exposure: A vendor or internal service publishes a spreadsheet to a widely accessed share; automated ingestion systems read and process the file, invoking Copilot Agent workflows that inadvertently send data externally.
• Automated discovery and mass data siphoning: Threat actors seed many public‑facing document sources with malicious files and harvest whatever Copilot Agents process automatically, scaling information collection quietly across many organizations.

All of these scenarios are realistic because the exploit vector requires network access but no user interaction or privilege escalation, as Microsoft’s advisory and multiple security trackers stress. That combination makes the vulnerability attractive to opportunistic attackers.

---

What we know about exploitation and public exposure​

At the time of patching and public disclosure, Microsoft and industry trackers stated there was no evidence of in‑the‑wild exploitation for CVE‑2026‑26144. Several sources echoed that while calling the attack model “likely to be seen more often” given the rise of agentic features. However, the mere existence of a weaponizable agent changes the calculus for detection and containment.
Historical context matters. Prior incidents such as the EchoLeak and Reprompt families of Copilot/agent vulnerabilities have already demonstrated that AI assistants can be abused for data leakage and that zero‑ or one‑click chains are feasible. The community’s documented experience with those incidents shows defenders should assume similar attack creativity will be applied here.

---

Mitigations — immediate steps for sysadmins and security teams​

Microsoft has released updates addressing CVE‑2026‑26144 as part of the March Patch Tuesday rollup; applying the vendor patch is the primary and recommended remediation. For organizations that cannot patch immediately, layered mitigations can reduce exposure.
Short‑term mitigations (apply immediately if patching is delayed):

• Restrict outbound network traffic from Office processes. Use host‑level firewall rules or network egress controls to limit which endpoints Excel/Office can contact. Blocking all Office‑originated outbound requests except to approved internal services greatly reduces risk.
• Disable or limit Copilot Agent features until the patch has been installed in your environment. If Copilot Agent mode can be turned off centrally via policy or Intune, do so for high‑risk user groups.
• Monitor Excel network activity and anomalous HTTP/HTTPS requests emanating from Office processes. Unusual DNS queries, requests to newly seen endpoints, or traffic to known malicious infrastructure should trigger incident response.
• Harden file handling and preview settings: disable automatic preview processing in mail clients and collaboration tools where possible; configure protected view and sandboxing features conservatively. Evidence from other Office preview‑pane RCE issues shows preview features can be used to trigger dangerous flows without explicit user clicks.

Longer‑term mitigations and process changes:

• Inventory and policy control for agent features: maintain a clear inventory of which endpoints have Copilot Agent enabled and apply least‑privilege networking and data access to those hosts.
• Egress filtering and data‑loss prevention (DLP) rules that are aware of Office‑originated telemetry and agent behavior — adapt DLP to detect large or unusual outbound transfers that include document fragments, tables, or tabular data patterns.
• Threat hunting for unusual agent‑driven activity: add detection logic to EDR and SIEM to correlate Office process activity with network connections, especially to non‑whitelisted destinations. Prioritize detection of POST/PUT requests or data uploads from Excel/office processes.

---

Patching strategy and operational guidance​

• Prioritize patching for high‑value groups first. Finance, legal, HR and executive support groups (those most likely to handle sensitive spreadsheets) should be first. Patch cohorts by risk profile.
• Test updates in a representative staging pool. Microsoft’s patches cover many Office components; run updates in a test ring with telemetry enabled to ensure Copilot controls and automation scripts behave correctly before full rollout.
• Coordinate egress rules with patching windows. If you temporarily restrict outbound Office network access as a mitigation, plan for staged rollback as machines are patched to avoid workflow disruption.
• Communicate to users and teams. Let users know Copilot features may be disabled or restricted during remediation and explain why — that reduces helpdesk churn and unusual bypass attempts.

Patch or mitigate promptly. Multiple advisory summaries call CVE‑2026‑26144 one of the critical operational items from this Patch Tuesday because of the real‑world exfiltration potential, regardless of the numeric CVSS bin.

---

Detection and hunting playbook (practical steps)​

• Alert on Office parent process (e.g., Excel.exe) spawning network sockets to destinations outside corporate allowlists.
• Hunt for new or rare User‑Agent strings from Office processes and for HTTP requests that contain structured data (CSV, JSON, HTML snippets) right after Excel process activity.
• Correlate file sources with network activity: if a newly arrived workbook or email attachment is processed within minutes of outbound Office‑originated POSTs, escalate.
• Leverage DLP to look for tabular patterns, frequent column headers like “SSN”, “Account”, “Balance”, or other high‑value markers appearing in outbound payloads.
• Use EDR telemetry to capture memory and process snapshots for any Excel process that shows network activity to unknown destinations; these artifacts accelerate forensic analysis.

These detection priorities reflect the attack mechanics: Excel processes + Copilot activity + network egress. Teams that instrument these three axes gain the best chance to detect a stealthy, zero‑click exfiltration chain.

---

Broader implications: AI agents and software vulnerabilities​

CVE‑2026‑26144 is not just a single‑product problem — it’s a signal about how agentic AI features change vulnerability risk profiles across software ecosystems.

• Software that can act on data and has network privileges becomes a privileged platform in its own right. Bugs that once only exposed local state can now be converted into remote exfiltration channels.
• Security scoring systems and triage playbooks must evolve to account for agent‑mediated attack amplification. A low‑complexity information‑disclosure bug can translate into high impact if an agent automatically processes and communicates the leaked data.
• Vendors need to treat agent endpoints as first‑class attack surfaces: hardened input validation, network‑least‑privilege, stronger telemetry, and privacy‑aware default posture for autonomous features.

Researchers and practitioners have been warning about these risks since the first zero‑click/agent leaks surfaced (EchoLeak, Reprompt and others). CVE‑2026‑26144 is a practical example of that theoretical risk materializing in mainstream productivity software.

---

Vendor and industry commentary — what experts are saying​

• Dustin Childs at Zero Day Initiative called CVE‑2026‑26144 “fascinating,” emphasizing the attack mode’s novelty and the likelihood of similar attacks emerging as organizations adopt agentic features broadly.
• Action1’s security analysts highlighted the business impact: Excel spreadsheets routinely contain financial records, IP, and operational data, and the exploitation of an automated assistant to leak that data silently is an elevated concern for enterprise defenders. Action1 recommended restricting outbound Office traffic and disabling Copilot Agent until patches are applied.
• Mainstream security press called attention to the lack of evidence for active exploitation at release time, but warned defenders not to be complacent because the attack model lowers the bar for stealthy data collection.

These public reactions align on one clear point: even in the absence of confirmed in‑the‑wild abuse, the operational danger is real and warrants immediate action.

---

What defenders should not assume​

• Do not assume that a lack of public proof‑of‑concept or in‑the‑wild indicators equals low risk. Zero‑click paths can be quietly monetized and weaponized by small groups of attackers before becoming public.
• Do not rely on CVSS alone to drive prioritization. The presence of an agentic component that can act and network substantially increases real impact beyond what the numeric score may imply.
• Do not ignore endpoint telemetry. Traditional alerting that focuses on privilege escalation or code execution may miss stealthy data egress orchestrated by benign‑looking processes like Copilot Agent.

---

Recommended checklist for fast response (executive summary for ops)​

• Apply Microsoft’s March 2026 Office/Excel updates to all endpoints and servers that process Office documents — prioritize high‑value groups.
• If immediate patching is infeasible: restrict outbound Office egress, disable Copilot Agent centrally, and harden preview/automatic processing settings.
• Deploy detection rules for Office process network activity and hunt for anomalous POSTs/DNS lookups following Excel process launches.
• Audit which automation and ingestion workflows process spreadsheets without human review; add manual checkpoints or quarantines where possible.
• Update incident playbooks to include agent‑driven exfiltration vectors and ensure forensic captures include network captures and Office process memory dumps.

---

Conclusion​

CVE‑2026‑26144 is a timely reminder that the security calculus changes when autonomous AI features become first‑class citizens inside enterprise software. A relatively familiar bug class — cross‑site scripting — becomes far more dangerous when the vulnerable product contains an agent capable of reading, summarizing, and sending data automatically. The result is a practical zero‑click information disclosure attack that organizations cannot afford to treat as hypothetical.
The fix is available; the principles for defending against this class of attack are straightforward but operationally significant: patch quickly, restrict egress, disable agent automation where practical, and hunt actively for anomalous Office‑originated network activity. As AI agents are woven more tightly into workflows, defenders should assume attackers will experiment with these new enabling technologies — and they should prepare accordingly.

---

Source: theregister.com Critical Microsoft Excel bug weaponizes Copilot Agent