SearchLeak CVE-2026-42824: Bing SSRF Exfiltration of M365 Copilot Data

Ibrahim Saud@tektrix

•updated Jun 30, 2026•8•0•11

Detects potential data exfiltration (CVE-2026-42824) where an attacker leverages an SSRF vulnerability in Bing's search-by-image functionality to relay sensitive M365 Copilot data. The rule identifies outbound network requests to the image search endpoint containing a suspicious 'imgurl' parameter pointing to non-Microsoft infrastructure, initiated by common web browser processes.