| CVE Number | Vulnerability | Product | Severity | Date |
|---|---|---|---|---|
| CVE-2026-26144 | Microsoft Excel Information Disclosure Vulnerability | Microsoft 365 Apps | Critical | 07-04-2026 |
Technical Information
An unauthenticated attacker could exploit a cross-site scripting vulnerability to inject malicious input that triggers unintended network egress in Copilot Agent mode, resulting in zero-click information disclosure.
Patch release date: Mar 10, 2026
Further information on this vulnerability is available at : CVE-2026-26144
Affected Software
Microsoft 365 Apps for Enterprise for 64-bit Systems,Microsoft 365 Apps for Enterprise for 32-bit Systems