Critical Microsoft 365 Copilot Vulnerabilities Expose sensitive Information

Microsoft disclosed and fully mitigated three critical information-disclosure vulnerabilities in Microsoft 365 Copilot and Copilot Chat in Edge (CVE-2026-26129, CVE-2026-26164, CVE-2026-33111). The flaws allow potential exposure of sensitive enterprise data via network-based injection/neutralization issues, have high confidentiality impact but were mitigated on Microsoft’s cloud side with no public exploit or required action by customers.