Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps

Varonis Threat Labs has disclosed three vulnerabilities in Microsoft Copilot Personal that it said could allow a single click on a crafted link to silently pull data from connected apps and other information available to the victim's Copilot session. The flaws, which the researchers collectively...

CVE-2026-24301

creationtimestamp| type| source ---|---|--- 2026-08-18 16:50:47+00:00| seen| https://infosec.exchange/users/AAKL/statuses/117117540428017104 2026-08-19 03:00:20+00:00| seen| https://bsky.app/profile/newsfacts.bsky.social/post/3mtfqh6zemb2q 2026-08-19 05:41:57+00:00| seen|...

CVE-2026-24301 Microsoft Copilot Information Disclosure Vulnerability

...

CVE-2026-24301

Microsoft Copilot has an improper neutralization of special elements used in a command (command injection ) flaw. A network-based, unauthenticated attacker with user interaction can disclose information. CVSS 3.1 scores 8.8 HIGH (C:H/I:H/A:H). No in-the-wild exploitation or patch version is docum...

CVE-2026-24301 Microsoft Copilot Information Disclosure Vulnerability

...