New attack turned Microsoft 365 Copilot into 1-click data theft tool

What it is

SearchLeak (CVE-2026-42824) is a critical, maximum-severity vulnerability chain in Microsoft 365 Copilot Enterprise Search found by Varonis. Microsoft fixed it server-side at the beginning of the month.

What to do

Nothing to deploy. The fix is entirely on Microsoft's side — the page states plainly: "With Microsoft having fixed CVE-2026-42824, there's no user action required to mitigate this threat." No patch to apply, no config to change, no version boundary for tenants to check. For an engineer deciding whether to act, the answer is that the action is already taken care of upstream.

Why it's still worth your attention

The reason to read past the CVE is Varonis's generalizable lesson, not this specific bug. Three individually low-impact flaws — a parameter-to-prompt (q) injection, an HTML-rendering race condition, and a Bing "Search by Image" SSRF that bypasses the CSP allowlist — combined into a zero-typing, one-click mailbox/OneDrive/SharePoint exfiltration with no visible indicator (the victim sees only Copilot "thinking").

The takeaway the researchers stress: prompt injection re-weaponizes bug classes defenders had learned to contain. An SSRF "hiding in plain sight behind a CSP allowlist entry" and an HTML injection race — both routine, both normally low-severity — become potent when an LLM sits in the request path. If you run or build on Copilot Enterprise Search or similar AI agents, the durable action item is to reassess whether your existing SSRF and output-sanitization controls still hold once an attacker can steer the agent's behavior via untrusted input, since that context changes their impact.

Caveats

The page names only the outcome and mechanism, not exploitation prerequisites beyond a victim clicking a crafted link. No detection query, no affected version range, and no indication the flaw was exploited in the wild are given.