SearchLeak CVE-2026-42824: Bing SSRF imgurl Exfiltration from M365 Copilot

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects potential exfiltration of sensitive M365 data via an SSRF vulnerability (CVE-2026-42824). The rule identifies suspicious outbound network requests to Bing's image search service where the 'imgurl' parameter contains external, non-Microsoft URLs, suggesting the service is being used as a proxy to exfiltrate data.