SearchLeak CVE-2026-42824: M365 Copilot P2P Injection with Bing SSRF Exfiltration

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects a potential exploitation attempt of CVE-2026-42824, involving a parameter-to-prompt injection in M365 Copilot to extract sensitive data identifiers, followed by an exfiltration attempt via a Bing Search-by-Image SSRF request.