A newly disclosed vulnerability, known as SearchLeak, was discovered in Microsoft 365 Copilot Enterprise and allows attackers to steal sensitive organizational data via a specially crafted URL. The vulnerability chain, now tracked as CVE-2026-42824, was patched by Microsoft earlier this month and was rated critical due to its potential impact.
Varonis security researchers discovered the issue by combining three separate vulnerabilities that, on their own, presented limited risk. Together, however, they allowed attackers to silently extract emails, calendar information, SharePoint documents, OneDrive files, and other indexed enterprise content accessible through Microsoft 365 Copilot Enterprise.
How the SearchLeak vulnerability worked
According to the researchers, the SearchLeak vulnerability combined an AI-specific flaw known as Parameter-to-Prompt Injection (P2P) with two traditional web security: an HTML rendering race condition and a server-side request forgery (SSRF) vulnerability involving Bing.
The first stage exploited the search functionality of Microsoft 365 Copilot Enterprise, where the “q” URL parameter was passed directly to Copilot as an executable command. Instead of being treated as a simple search query, the attacker’s input could be interpreted as an instruction.
See also: Microsoft 365 Copilot: New design with twice the speed
The researchers showed that a malicious URL could instruct Copilot to search the victim's mailbox, retrieve email headers or other sensitive content , and embed the extracted data within an image URL without requiring any user interaction beyond a click.
Combining three weaknesses into one attack
The second stage was based on an HTML rendering race condition. While Microsoft attempted to neutralize potentially dangerous HTML by enclosing responses in code blocks, this protection only occurred after Copilot had finished generating its response. During the streaming phase, raw HTML, including image tags, could cause outbound requests before sanitization took effect.
See also: Microsoft Edge Copilot: New AI features
The final element of the SearchLeak vulnerability involved a Content Security Policy bypass via Bing. Since Bing domains were on the allowlist, the attackers exploited Bing's image search endpoint, which performs server-side fetching of image URLs. By embedding stolen data within these URLs, Bing unknowingly acted as a middleman, forwarding the information to servers controlled by the attackers.
As described by Varonis, the attack did not require any additional, elevated privileges, additional clicks, or suspicious domains. Victims only had to open a trusted Microsoft link.
Potential impact of CVE-2026-42824
Because Microsoft 365 Copilot Enterprise works with the user's existing permissions, successfully exploiting CVE-2026-42824 essentially gave attackers access to whatever information the targeted employee could access.
Potentially exposed data included email content, one-time passwords, password reset links, calendar events, meeting notes, attendee information, confidential communications, SharePoint files, OneDrive documents, earnings reports, salary information, acquisition plans , and other sensitive business records.
See also: Microsoft now makes Copilot optional
The researchers noted that the novelty of the SearchLeak vulnerability lies in how the AI-enabled prompt injection made older attack techniques practical in a new environment. Without the P2P vulnerability, attackers would not be able to inject malicious instructions; without the race condition, the HTML would be neutralized; and without the SSRF vulnerability, the Content Security Policy would block data extraction.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Microsoft has since patched the issue under CVE-2026-42824, but researchers say the case highlights how AI systems can introduce new attack paths.
The SearchLeak case clearly highlights that the integration of artificial intelligence into enterprise platforms creates new and often unforeseen cybersecurity. While the individual vulnerabilities exploited in the attack were known to the security community, their combination through AI capabilities demonstrated that traditional protection methods may not be sufficient against new, complex exploit chains.
