Critical SearchLeak Flaw in Microsoft 365 Copilot Exposed Sensitive Enterprise Data

Researchers at Varonis disclosed a critical Microsoft 365 Copilot Enterprise vulnerability (CVE-2026-42824, “SearchLeak”) that chained an AI-specific Parameter-to-Prompt Injection with an HTML rendering race condition and a Bing SSRF to exfiltrate emails, calendar entries, SharePoint/OneDrive documents, and other indexed enterprise content via specially crafted URLs; Microsoft has patched the issue but the case highlights how AI features can link previously known flaws into high-impact attacks.