---
schema: 1
kind: research
title: "Varonis \"SearchLeak\" (CVE-2026-42824): one-click M365 Copilot data exfiltration, now patched"
headline: "Varonis \"SearchLeak\" (CVE-2026-42824): one-click M365 Copilot data exfiltration, now patched"
summary: "Varonis Threat Labs disclosed SearchLeak, a three-stage chain in Microsoft 365 Copilot Enterprise Search that Microsoft patched server-side as CVE-2026-42824 (command-injection / information-disclosure, NVD CVSS 6.5) (Varonis, 2026-06-15; Microsoft MSRC)."
discovered_at: "2026-06-16T05:09:01Z"
event_date: 2026-06-15
run_id: 2026-06-16-38d638e1
priority: notable
immediate_action: null
tags:
  - vulnerabilities
  - ai-abuse
  - info-disclosure
  - identity
  - patch-available
regions:
  - global
sectors:
  - public-sector
  - technology
entities: []
cves:
  - id: CVE-2026-42824
    cvss: "6.5"
    epss: null
    type: info-disclosure
    vector: user-interaction
    auth: pre-auth
    status:
      - patch-available
sources:
  - url: "https://www.varonis.com/blog/searchleak"
    publisher: Varonis Threat Labs
    role: primary
  - url: "https://thehackernews.com/2026/06/one-click-microsoft-365-copilot-flaw.html"
    publisher: The Hacker News
    role: corroborating
closed_sources: []
evidence: []
verification: multi-source
sourcing_note: null
confidence: high
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
watchlist_hit: false
actions:
  - "**Confirm M365 Copilot tenants are on the patched build (CVE-2026-42824)** and add CASB/DLP detection for Copilot search URLs carrying HTML-encoded `q` parameters or fetching to non-Microsoft domains."
migrated_from: briefs/2026-06-16.md
---

Varonis Threat Labs disclosed **SearchLeak**, a three-stage chain in Microsoft 365 Copilot Enterprise Search that Microsoft patched server-side as **CVE-2026-42824** (command-injection / information-disclosure, NVD CVSS 6.5) ([Varonis, 2026-06-15](https://www.varonis.com/blog/searchleak); [Microsoft MSRC](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42824)). Stage 1: the `q` URL parameter is passed to Copilot as an executable instruction rather than a sanitised query (parameter-to-prompt injection). Stage 2: an injected `<img>` tag fires during a streaming-render race before the output sanitiser runs. Stage 3: the exfiltration request is relayed through Bing's server-side image-search fetch — `*.bing.com` is allowlisted in Copilot's CSP — bypassing the browser CSP and carrying mailbox content, calendar entries, SharePoint/OneDrive files and emailed MFA/OTP codes to an attacker domain, all from a single click on a genuine `microsoft.com` link ([The Hacker News, 2026-06-15](https://thehackernews.com/2026/06/one-click-microsoft-365-copilot-flaw.html)). No customer action is required for patched tenants and no in-the-wild exploitation was observed. Mapped to `T1566.002` and `T1071.001`.

**Why it matters to us:** M365 Copilot Enterprise is in active Swiss-federal and EU public-sector rollouts. The vulnerability class — prompt injection via URL parameter, streaming-render race, and SSRF-relay CSP bypass — will recur in other AI-augmented enterprise apps; build CASB/DLP detection for Copilot search URLs carrying HTML-encoded payloads in the `q` parameter and for Copilot sessions fetching to non-Microsoft domains.