Microsoft 365 vendor security report

Security & Breach News (last 12 months)

• Critical Microsoft 365 Copilot Vulnerabilities Expose sensitive Information

  Microsoft disclosed three critical information disclosure vulnerabilities affecting Microsoft 365 Copilot and Copilot Chat that have been fully remediated. These vulnerabilities could have exposed sensitive information to unauthorized access.

  CyberSecurityNewsMay 12, 2026

  high
• Critical SharePoint zero-day leaves 1,300+ servers exposed

  A critical zero-day vulnerability (CVE-2026-32201) in Microsoft SharePoint is being actively exploited in the wild, with over 1,300 server instances currently exposed. This represents a confirmed vulnerability with active exploitation against a Microsoft 365 component.

  MSNMay 8, 2026

  high
• Microsoft's patch for a 0-day exploited by Russian spies fell short. Another Windows flaw is under attack

  Microsoft and CISA warned of an actively exploited zero-click Windows vulnerability that can expose systems to attack. The flaw represents a confirmed security incident affecting Windows systems, though the article indicates Microsoft's previous patch for a related 0-day was insufficient.

  The RegisterMay 6, 2026

  high
• Microsoft Copilot privacy setting may pull data from other apps

  A Copilot privacy setting was identified that can access and pull data from other Microsoft services (Bing, MSN, Edge) to personalize responses, raising data handling and privacy concerns. This represents a configuration/privacy practice issue requiring investigation and potential user notification rather than a confirmed active breach.

  MSNMay 5, 2026

  medium
• Salesforce and Slack sue Microsoft in UK for playing monopoly with Teams bundles

  Microsoft faces a UK antitrust lawsuit from Slack and Salesforce alleging anticompetitive bundling practices with Microsoft Teams. This is a regulatory/legal action rather than a security incident, but represents significant legal and compliance risk to the Microsoft 365 vendor.

  Windows CentralMay 5, 2026

  medium
• Mandiant Exposes Hackers Impersonating Microsoft Teams Help Desk

  Mandiant identified UNC6692 threat actors exploiting Microsoft Teams to impersonate IT help desk personnel and deploy SNOW malware, with 77% of attacks targeting senior corporate staff. This represents a confirmed active incident leveraging Microsoft 365 infrastructure as an attack vector for credential theft and malware distribution.

  SQ MagazineMay 4, 2026

  high