Critical Microsoft 365 Copilot CVE-2024-30044 Vulnerability Lets Attackers Steal Data

Key Takeaways

• A critical vulnerability chain, dubbed “SearchLeak,” in Microsoft 365 Copilot Enterprise allowed attackers to steal sensitive corporate data.
• The exploit, tracked as CVE-2026-42824, combined an AI-specific weakness with two traditional web security flaws.
• A single click on a specially crafted link pointing to a legitimate Microsoft domain could trigger the data exfiltration.
• Microsoft has released a server-side patch for this vulnerability, requiring no user action.

A sophisticated attack chain within Microsoft 365 Copilot Enterprise, capable of exfiltrating sensitive corporate data including multi-factor authentication (MFA) codes, email contents, calendar details, and confidential files, has been identified. This critical vulnerability, named SearchLeak by researchers, allowed unauthorized access through a single click on a malicious link disguised as a legitimate Microsoft domain.

Discovered by Varonis Threat Labs and tracked by Microsoft as CVE-2026-42824, the flaw received Microsoft’s highest severity rating before being addressed. Its danger stemmed not from an individual bug, but from the novel combination of an AI-specific weakness with two established web security vulnerabilities, effectively turning Copilot Enterprise Search into a covert data exfiltration channel.

SearchLeak functions as a multi-stage exploit, weaponizing Microsoft 365 Copilot Enterprise Search to silently extract data. Varonis researcher Dolev Taler detailed the attack, which leverages three distinct weaknesses: a Parameter-to-Prompt (P2P) Injection, an HTML rendering race condition, and a Server-Side Request Forgery (SSRF) via Bing’s image search endpoint.

While each of these vulnerabilities might be manageable in isolation, their combination created a potent, one-click attack. This allowed the theft of virtually any data accessible to the victim within their Microsoft 365 tenant, without requiring special privileges, additional plugins, or secondary user interactions.

Microsoft 365 Copilot Vulnerability Chain

Stage 1 — Parameter-to-Prompt (P2P) Injection

The initial stage exploits how Microsoft 365 Copilot Search processes the q URL parameter, which is designed for natural language search queries. The vulnerability arises because Copilot’s AI engine interprets the value supplied in the q parameter not merely as a search string, but as executable instructions. An attacker could craft a malicious URL pointing to a trusted microsoft.com domain, instructing Copilot to search the victim’s mailbox and embed the retrieved data within an image URL. Because the link appears to originate from a legitimate Microsoft domain, it bypasses common anti-phishing and URL protection mechanisms.

Stage 2 — Racing the Guardrail

Microsoft implemented a safeguard to prevent dangerous AI-generated HTML by wrapping Copilot’s output in <code> blocks, which stops the browser from rendering it as live markup. However, this protective wrapping only occurs after Copilot completes its content generation. During the streaming phase, raw HTML, including attacker-injected <img> tags, is temporarily rendered directly into the Document Object Model (DOM). This allows the browser to initiate the HTTP request from the <img> tag before the sanitization process can activate, creating a classic race condition bypass.

Stage 3 — Server-Side Request Forgery (SSRF) via Bing

Due to the Content Security Policy (CSP) on m365.cloud.microsoft, the victim’s browser cannot directly connect to an attacker-controlled server. However, *.bing.com is allowlisted in the CSP. Bing’s “Search by Image” feature accepts an imgurl parameter and performs a server-side fetch of the provided URL for analysis. The attacker embeds the stolen data directly into the path of this Bing image-search URL. Bing’s backend then unwittingly relays the exfiltrated data to the attacker’s server, completely circumventing the CSP.

The entire attack is initiated by simply sending a specially crafted link via email, Teams, Slack, or any other messaging platform. Upon clicking, Copilot silently searches the victim’s mailbox, generates a response that embeds the stolen data within a Bing image URL, and the attacker’s server logs the exfiltrated information—all within seconds and without any further user interaction.

What You Should Do

Microsoft has deployed a server-side patch for the SearchLeak vulnerability, meaning no direct user action is required to receive the fix. However, Varonis recommends that security teams implement the following proactive measures:

• Continuously monitor Copilot Search URLs for any encoded payloads within the q parameter that contain HTML or image-embedding instructions.
• Regularly audit Content Security Policy (CSP) allowlists, particularly for any domains that perform server-side fetches on user-supplied URLs.
• Treat all AI streaming output as inherently untrusted. Ensure that sanitization processes occur at render time, rather than as a post-processing step.
• Educate users to carefully inspect Microsoft 365 links, especially those with unusually long or heavily encoded query strings, before clicking.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.