Wednesday, June 17, 2026 · 2 of 5

1. SearchLeak: a one-click M365 Copilot bug could exfiltrate emails, files, and MFA codes

   Chained prompt injection + HTML race + Bing SSRF, max severity (CVE-2026-42824), now patched server-side

   Jun 15Security