Thursday, April 16, 2026 · 2 of 5
Copilot Studio ShareLeak (CVE-2026-21520)
— Microsoft patched this Jan 15, but VentureBeat reports data exfiltrated anyway in post-patch testing; Salesforce Agentforce also vulnerable to similar form-based prompt injection