Microsoft has resolved three critical vulnerabilities affecting its 365 Copilot and Copilot Chat services, both integral to Microsoft Edge. Released on May 7, 2026, these disclosures require no action from end users or administrators, as Microsoft has already addressed the issues on their end. The vulnerabilities, identified as CVE-2026-26129, CVE-2026-26164, and CVE-2026-33111, pose a significant risk due to their classification in the Information Disclosure category. Microsoft's Security Response Center has emphasized its commitment to transparency by publishing detailed advisories as part of its cloud CVE transparency initiative.

CVE-2026-26129 impacts Microsoft 365 Copilot's Business Chat. It involves improper handling of special elements, potentially allowing unauthorized disclosure of sensitive information over a network. Though full CVSS metrics were not disclosed, the critical severity rating reflects the high confidentiality risk associated with the enterprise data access model of Copilot. Similarly, CVE-2026-26164 targets Copilot and falls under CWE-74, with a network-based attack vector that requires no privileges or user interaction, presenting a high confidentiality impact. CVE-2026-33111 affects Copilot Chat in Microsoft Edge, classified under CWE-77, sharing a CVSS score of 7.5 with CVE-2026-26164 and possessing a comparable attack profile.

The widespread use of Edge in enterprises heightens concerns, as these vulnerabilities expose AI-powered productivity tools to potential exploitation. Copilot's ability to aggregate vast amounts of data, including emails and documents, underscores the importance of secure handling of special elements to prevent information leakage. Microsoft has credited Estevam Arantes and independent researcher 0xSombra for discovering these vulnerabilities. None were publicly disclosed or exploited before the advisories were published. With mitigations now in place at the cloud service layer, enterprises are advised to review and adjust Copilot's data access permissions, ensuring adherence to least-privilege principles to prevent future issues.