Top entities: Varonis Systems, BingX, Microsoft.

What category does this event fall under?

Tech — classified as vulnerability discovery.

What is the sentiment of coverage?

Aggregate sentiment score: -70 on a -100 to +100 scale (negative = critical coverage, positive = favorable coverage).

Is this event still developing?

This event is archived — the story has concluded and this page is a final snapshot.

Tech vulnerability discovery

Microsoft 365 Copilot SearchLeak Patched

Q: When did this event occur?

First reported Jun 15, 2026; last updated Jun 16, 2026.

Q: What is the market impact?

General. The discovery of the SearchLeak vulnerability in Microsoft Copilot Enterprise by Varonis Systems and its subsequent patching by Microsoft could lead to increased scrutiny of AI-powered enterprise tools.

Analysis based on 6 articles · First reported Jun 15, 2026 · Last updated Jun 16, 2026

Sentiment

-70

Attention

Articles

Market Impact

General

Live prominence charts, article sentiment distribution, and event development timeline available on the Ergen Dashboard

Market Impact

The discovery of the SearchLeak vulnerability in Microsoft Copilot Enterprise by Varonis Systems and its subsequent patching by Microsoft could lead to increased scrutiny of AI-powered enterprise tools. While Microsoft has addressed the flaw, the event highlights potential new attack surfaces in cloud services, which may prompt companies to re-evaluate their cybersecurity strategies and potentially increase spending on security solutions, benefiting cybersecurity firms like Varonis Systems.

Software Cybersecurity Cloud Computing

Event Summary

Security researchers at Varonis Systems Threat Labs discovered a critical vulnerability chain, dubbed SearchLeak (CVE-2026-42824), in Microsoft Copilot Enterprise. This flaw allowed attackers to steal sensitive corporate data, including emails, MFA codes, calendar details, and confidential files, with a single click on a legitimate Microsoft domain link. The attack combined a Parameter-to-Prompt (P2P) Injection, an HTML rendering race condition, and a Server-Side Request Forgery (SSRF) via BingX's image search endpoint. Microsoft has since fully patched the vulnerability server-side, requiring no user action for mitigation. The incident underscores how AI assistants can create new attack surfaces by reactivating previously unexploitable classic vulnerabilities.

Entities Involved

stock

Varonis Systems

Varonis Systems Threat Labs discovered and disclosed the SearchLeak vulnerability, enhancing its reputation as a cybersecurity research firm and potentially increasing demand for its security solutions.

Importance 80.0 Sentiment 50.0

exch

BingX

BingX's 'Search by Image' feature was exploited as part of the SearchLeak vulnerability chain to bypass Content Security Policy, highlighting a weakness in its design that Microsoft has since patched. BingX is a subsidiary of Microsoft.

Importance 60.0 Sentiment -30.0

stock

Microsoft

Importance 0.0 Sentiment 0.0

ERGEN INTELLIGENCE

Track this event live

Set up alerts, explore entity relationships, search across thousands of events, and build custom intelligence feeds.

Open Dashboard