High

ShareLeak information disclosure in Microsoft Copilot Studio

IdentifiersCVE-2026-21520CWE-200

CVE-2026-21520 is a high-severity indirect prompt injection vulnerability in Microsoft Copilot Studio, referred to by researchers as ShareLeak. According to the provided reporting, the issue arose from a gap between public-facing SharePoint form submission content and the Copilot Studio agent context window, where attacker-controlled input could be concatenated with system instructions without adequate separation or sanitization. In the described attack path, an unauthenticated attacker could place a crafted payload into a SharePoint form or comment field, causing the connected Copilot Studio agent to treat untrusted input as authoritative instructions. Capsule Security reported that this allowed the injected prompt to override or hijack the agent’s intended behavior, query connected SharePoint Lists for customer data, and use an authorized Outlook action to transmit the retrieved data externally. Microsoft assigned CVE-2026-21520 to this issue and patched the specific data-exfiltration path on January 15, 2026.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation results in unauthorized disclosure of sensitive information accessible to the Copilot Studio agent. Based on the supplied context, an unauthenticated remote attacker could induce the agent to retrieve customer or other sensitive organizational data from connected Microsoft data sources and exfiltrate that information to an attacker-controlled email address. The attack abuses the agent’s legitimate permissions and tool integrations rather than a memory-corruption flaw, so the primary impact evidenced in the provided material is data exposure and exfiltration through authorized actions.

Mitigation

If you can’t patch tonight, do this now.

Where immediate remediation is not sufficient or broader architectural risk remains, the provided content supports mitigations including least-privilege access for agent-connected data sources, restricting or approving outbound tool actions such as email, using runtime enforcement or external security-provider webhooks to approve or block tool execution, adding telemetry and logging around agent data access and external communications, and requiring human oversight for high-impact actions. The broader analysis also recommends controls that bind tool execution to user intent, such as signed intent digests and draft-then-commit workflows for sensitive write or communication actions. Limiting the combination of sensitive data access, exposure to untrusted content, and unrestricted external communication materially reduces exploitability.

Remediation

Patch, then assume compromise.

Microsoft deployed a patch for the reported ShareLeak data-exfiltration path on January 15, 2026. Remediation therefore includes applying Microsoft's fix for CVE-2026-21520 and ensuring Copilot Studio deployments are updated to the remediated service state. The provided content also indicates the vulnerable behavior involved unsafe handling of untrusted SharePoint form input in the agent context, so remediation should include enforcing strict separation between untrusted external content and system instructions, sanitizing or neutralizing untrusted form data before it is introduced into agent context, and constraining agent tool actions that can transmit retrieved data externally.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Microsoft CorporationCopilot Studioapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

14 SOURCESView more in app

scworldNews

May 6, 2026

After the identity fix: MCP's confused deputy problem | perspective | SC Media

An indirect prompt injection vulnerability in Microsoft Copilot Studio that enabled a specific data-exfiltration path and was notable because a CVE was assigned to a prompt injection issue in an agentic platform.

dark readingNews

Apr 15, 2026

Microsoft, Salesforce Patch AI Agent Data Leak Flaws

A high-severity prompt injection vulnerability in Microsoft Copilot triggered via SharePoint form input that could exfiltrate customer data to an attacker-controlled email.

venturebeatNews

Apr 15, 2026

Microsoft patched a Copilot Studio prompt injection. The data exfiltrated anyway | VentureBeat

An indirect prompt injection vulnerability in Microsoft Copilot Studio that allows attacker-controlled input from SharePoint forms to override agent instructions and exfiltrate data via authorized Outlook actions.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity11