Microsoft Copilot M365 vulnerability enabled undetectable file access
A critical vulnerability in Microsoft's Copilot for M365, discovered in July 2024, allowed users to access sensitive files without creating audit logs. Microsoft patched the flaw but reportedly did not issue a CVE or notify customers, leaving organizations unaware of the risk.
What happened
A critical vulnerability was discovered in Microsoft's Copilot for M365 that allowed users to access and interact with sensitive files without leaving any record in audit logs.
The flaw was discovered in July 2024 and classified as an 'important' vulnerability by Microsoft. After patching, Microsoft reportedly decided against issuing a formal CVE or notifying its customers.
Reported impact
The vulnerability created significant security and compliance risks for organizations worldwide, potentially enabling malicious insiders or attackers to access sensitive files while evading detection.
Organizations remained unaware of the vulnerability despite the patch being issued.
Governance controls
Microsoft patched the vulnerability but did not issue a formal CVE notification or customer advisory regarding the flaw and its remediation.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.