CVE-2025-32711: EchoLeak Vulnerability in Microsoft 365 Copilot
June 25, 2026
EchoLeak is a prompt injection vulnerability in Microsoft 365 Copilot disclosed by Aim Security in June 2025. An attacker could craft an email that makes the assistant leak internal files without any user interaction. Microsoft patched the flaw, and no real-world exploitation was reported.