A single click on a trusted Microsoft link could have enabled an attacker to extract emails, calendar details, and indexed files from Microsoft 365 Copilot Enterprise Search.
Researchers at Varonis Threat Labs combined three vulnerabilities into a one-click exfiltration path they have named SearchLeak. Because the link pointed to a legitimate microsoft.com domain, conventional anti-phishing and URL filtering tools were unlikely to flag it.
No prompt, no password, no additional click required. Microsoft assigned CVE-2026-42824 and rated it critical; the CVSS scores were lower and inconsistent, with Microsoft giving a 6.5 and the National Vulnerability Database a 7.5. The company addressed the flaw on its backend, so customers have no cause for concern, and Varonis presented a proof-of-concept, not observed exploitation.
Three vulnerabilities, one click
Microsoft's advisory describes the flaw as a command injection capable of exposing information over a network. In practice, SearchLeak combines one AI-specific weakness with two older web vulnerabilities, and each link is essential for the next.
The entry point is the q parameter in the Copilot Enterprise Search URL. It is intended for a natural-language query, but Copilot interprets whatever is placed there as instructions, not merely a search string.
Varonis terms this Parameter-to-Prompt injection. An attacker crafts a URL that instructs Copilot to search the mailbox, extract an email title, and embed it within an image URL. The victim types nothing. They click, and Copilot executes the task.
Next is a race condition in how the response is rendered. Microsoft's safeguard wraps Copilot output in <code> blocks to ensure the browser treats markup as text. The issue is timing: the wrapping occurs after Copilot finishes generating, but the browser renders the stream as it arrives. The injected <img> tag is drawn and triggers its request before the sanitizer runs. By the time the output is neutralized, the request has already been sent.
The final link gets the data past the page's Content Security Policy. The CSP on m365.cloud.microsoft blocks images from arbitrary domains, but it allowlists *.bing.com. Bing's "Search by Image" endpoint accepts an image URL and fetches it server-side for analysis. Directing that fetch at an attacker's server with the stolen text encoded in the path, and Bing retrieves it. The browser's CSP never applies, because the request originates from Bing's infrastructure. Bing becomes the exfiltration proxy. The CSP allowlist does the concealing.
In summary: the victim clicks, Copilot searches their data, the response embeds a value like an email subject in a Bing image URL, the browser calls Bing during streaming, and Bing retrieves the attacker's URL. The attacker reads it from their own logs, for example, a request for /Your_Security_Code_847291/img.png.
What an attacker obtains
Copilot Enterprise can access whatever the signed-in user can, through their Microsoft Graph access, and the attacker inherits that access without ever logging in.
The most time-sensitive prize lies in the inbox: one-time codes, MFA codes, and password-reset links, often still valid for a few minutes. A script that extracts those from a log while the window is open can take over an account before anyone notices.
The same access also reaches calendar invites, meeting notes, and any SharePoint or OneDrive file Copilot has indexed, where salary data, earnings figures, and acquisition plans reside.
SearchLeak is the second time Varonis has demonstrated this pattern. Varonis researcher Dolev Taler showcased the same one-click technique in an earlier Reprompt attack against Copilot Personal, and it held up against Enterprise Search despite the additional guardrails that tier is supposed to enforce.
The same pattern appeared in EchoLeak (CVE-2025-32711), the zero-click Copilot data-leak bug Aim Security disclosed in 2025. SSRF and sanitizer races are old bug classes; the prompt injection is the new element, and it makes them accessible again.
Microsoft addressed the flaw on its backend, and because Copilot Enterprise is a managed service, tenant admins cannot patch or reconfigure the parts that failed. What they can do is monitor and contain.
Look for Copilot Search URLs carrying encoded payloads or HTML in the q parameter, and for unusual outbound requests to Bing's image endpoints. Tighten data-access governance so Copilot indexes less, which reduces what any future leak can access.