Critical Microsoft Excel bug weaponizes Copilot Agent for zero-click information disclosure attack

Microsoft's March 2026 Patch Tuesday addresses multiple vulnerabilities, notably CVE-2026-26144 — a critical Excel cross-site scripting/information-disclosure flaw that can cause Copilot Agent to exfiltrate data in a zero-click scenario — plus Office remote code execution flaws (Preview Pane) and other CVEs; the report emphasizes high impact to corporate data, required mitigations (patching, limiting outbound Office network access, monitoring Excel network activity, disabling Copilot Agent), and notes that these are not reported as actively exploited at disclosure.