{"id":60291,"date":"2026-03-10T20:35:16","date_gmt":"2026-03-10T20:35:16","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/critical-microsoft-excel-bug-weaponizes-copilot-agent-for-zero-click-information-disclosure-attack\/"},"modified":"2026-03-10T20:35:16","modified_gmt":"2026-03-10T20:35:16","slug":"critical-microsoft-excel-bug-weaponizes-copilot-agent-for-zero-click-information-disclosure-attack","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/critical-microsoft-excel-bug-weaponizes-copilot-agent-for-zero-click-information-disclosure-attack\/","title":{"rendered":"Critical Microsoft Excel bug weaponizes Copilot Agent for zero-click information disclosure attack"},"content":{"rendered":"

After a whopper of a Patch Tuesday last month<\/a>, with six Microsoft flaws exploited as zero-days, March didn’t exactly roar in like a lion. Just two of the 83 Microsoft CVEs released on Tuesday are listed as publicly known, and none is under active exploitation, which we’re sure is a welcome change to sysadmins.<\/p>\n

Another eight of the 83 Microsoft CVEs<\/a> are considered critical, and one of these – to quote Zero Day Initiative chief bug hunter Dustin Childs – is “fascinating.” Plus, it’s got an AI-attack component<\/a>, so we’re going to start with it.<\/p>\n

CVE-2026-26144<\/a> is a critical-severity information disclosure vulnerability in Microsoft Excel. This cross-site scripting flaw can be exploited to “cause Copilot Agent mode to exfiltrate data via unintended network egress, enabling a zero-click information disclosure attack,” Redmond warned. <\/p>\n