CVE-2026-42824

This issue is about a weakness in how Microsoft 365 Copilot handles certain inputs sent over the network. In simple terms: if someone figures out how to “trick” it, they may be able to get it to show information they shouldn’t. Think of it like slipping a note into a mailbox that changes how the mail gets read—if the system doesn’t properly handle that trick, private information can leak.

This matters to you if you use or run Microsoft 365 Copilot (listed as “microsoft copilot” and “Microsoft Microsoft 365 Copilot”). If your business relies on these tools to view or work with business content, you should treat this as a real data-protection concern. It’s not specific to a rare niche product—if you’re a Microsoft 365 Copilot customer, you’re in scope.

Do this soon—within the next few days—as this is an AMBER issue and press attention is rising due to a patch. Even though there’s no known public exploit and no evidence from CISA KEV that it’s widely exploited yet, there is a proof-of-concept publicly discussed, which means motivated attackers may start testing quickly. The practical goal is to ensure your tenant is updated and protected before anyone tries to use the trick.