Microsoft 365 Copilot's one-click vulnerability, dubbed SearchLeak by Varonis Threat Labs, could have severe implications for enterprise security. This vulnerability, assigned CVE-2026-42824, allows attackers to extract sensitive information from Microsoft 365 Copilot Enterprise Search with just a single click. The issue stems from a combination of three bugs: Parameter-to-Prompt injection, a race condition in response rendering, and a Content Security Policy (CSP) bypass. These bugs enable attackers to manipulate Copilot's search functionality, extract data, and potentially steal sensitive information like emails, calendar details, and indexed files.
What makes this vulnerability particularly insidious is the ease of exploitation. Traditional anti-phishing and URL filtering tools are unlikely to flag the malicious link because it points to a legitimate microsoft.com domain. The attacker simply needs to craft a URL that instructs Copilot to search the victim's mailbox and extract data, all without requiring any user interaction. This one-click attack vector is a significant concern for organizations using Microsoft 365 Copilot Enterprise Search.
The potential impact of this vulnerability is vast. Attackers can access a wide range of sensitive data, including one-time codes, MFA codes, and password-reset links, which could be used for account takeovers. Additionally, Copilot's access to Microsoft Graph and the ability to reach whatever the signed-in user can access means that attackers can also steal calendar invites, meeting notes, and files from SharePoint or OneDrive. This could lead to significant data breaches and financial losses for organizations.
This is not the first time Varonis has uncovered such vulnerabilities in Copilot. The Reprompt attack and EchoLeak demonstrate similar patterns, highlighting the ongoing challenges in securing AI-powered search functionalities. The combination of prompt injection and sanitizer races makes these vulnerabilities particularly difficult to mitigate, as they exploit the very features that make AI-powered search powerful.
Microsoft has mitigated the flaw on its backend, but the managed nature of Copilot Enterprise means that tenant admins cannot patch or reconfigure the affected components. The best course of action for organizations is to closely monitor their Copilot Search URLs for encoded payloads or HTML in the q parameter and unusual outbound requests to Bing's image endpoints. Tightening data-access governance to limit Copilot's indexing capabilities can also reduce the potential impact of future leaks.
In conclusion, the SearchLeak vulnerability in Microsoft 365 Copilot Enterprise Search highlights the ongoing need for vigilance in enterprise security. As AI-powered search functionalities become more prevalent, organizations must remain vigilant and proactive in protecting their sensitive data from potential threats.
