CVE-2026-42824: Microsoft 365 Copilot Enterprise Search Vulnerability
June 25, 2026
A critical command injection vulnerability in Microsoft 365 Copilot Enterprise Search, discovered by Varonis Threat Labs, allows one-click data exfiltration. Microsoft assigned a CVSS score of 6.5, while NVD rated it 7.5. The flaw was mitigated on the backend with no customer action required.