Two Enterprise AI Tools Exposed Admin Access and Mailbox Data in the Same Two Weeks

What Broke, and When

Two separate research teams published disclosures within four days of each other, and the underlying failure in both cases was the same: enterprise AI accepted attacker-controlled input with no meaningful trust barrier between the outside world and privileged internal resources.

On June 15, Varonis disclosed SearchLeak (CVE-2026-42824), a proof-of-concept exfiltration chain targeting Microsoft 365 Copilot Enterprise Search. The attack requires a victim to click a crafted microsoft.com URL — one click, no plugins, no second prompt. Once clicked, Copilot searches the victim's mailbox and routes the stolen data out through a Bing server-side request forgery (SSRF). The Bing image-search endpoint was already allowlisted in the Content Security Policy, so the exfiltration path was effectively pre-approved by the system itself.

Microsoft rated the flaw critical and patched it server-side, according to Varonis. The National Vulnerability Database has not yet issued a score; a third-party tracker lists it at 6.5 medium. The severity number is contested. The mechanism is not.

The Escalation Pattern at Copilot

SearchLeak is the third Varonis-documented Copilot exfiltration chain in twelve months. Reprompt, disclosed in January 2026, hit Copilot Personal. EchoLeak, disclosed in 2025, preceded that. Each chain has gotten closer to enterprise-scale exposure.

Enterprise Search inherits the authenticated user's full organizational permissions. That means the blast radius of SearchLeak is not one inbox. It is every document, email, and SharePoint file the victim can legitimately access — which, for a typical knowledge worker, covers a significant slice of an organization's internal data.

LiteLLM: From Default User to Root Shell

Four days before the Copilot disclosure, Obsidian Security published a three-CVE chain against LiteLLM, the open-source gateway that proxies API calls to OpenAI, Anthropic, Azure OpenAI, and AWS Bedrock behind a single endpoint. LiteLLM is widely deployed in enterprises that want a unified access layer for multiple AI providers.

Obsidian's chain runs in three moves. CVE-2026-47101 is an authorization bypass that lets a non-admin account mint a wildcard API key. CVE-2026-47102 promotes that caller to proxy admin through an unguarded `/user/update` endpoint. CVE-2026-40217 escapes the code sandbox via Python's `exec()` with full builtins still available.

Obsidian then demonstrated a reverse shell by injecting a forged tool-call response through LiteLLM's callback mechanism. The combined chain carries a CVSS score of 9.9 per Obsidian's assessment. One word typed by a developer. One shell for the attacker.

A separate LiteLLM flaw adds urgency. CVE-2026-42271, a command-injection bug in the MCP test endpoints, landed on CISA's Known Exploited Vulnerabilities list on June 8 with a June 22 remediation deadline. That is this coming Monday. CISA's KEV entry covers a distinct disclosure from the Obsidian chain. Organizations may need to patch both separately.

The Strongest Counterargument

Security professionals who have reviewed disclosures like these often note that proof-of-concept chains in controlled research environments do not always translate cleanly to real-world exploitation. SearchLeak, for instance, requires a victim to click a specifically crafted URL. Phishing-dependent attacks have a lower success rate than unauthenticated remote exploits. Microsoft's server-side patch for SearchLeak is already deployed, meaning no client action is needed for that specific CVE.

Patched is patched, and enterprise customers who are fully updated are not exposed to SearchLeak as described.

Three Copilot exfiltration chains in twelve months suggests the architecture, not just the individual bug, has a recurring structural problem with trust boundaries. The LiteLLM chain is not patched by a vendor push to a cloud backend. It runs on infrastructure that enterprise teams manage themselves, meaning every organization using LiteLLM needs to verify its own version and configuration.

Five Checks Before the Deadline

VentureBeat's coverage of the Varonis and Obsidian disclosures outlined a five-check audit framework. Mapped to the specific CVEs:

1. Confirm your LiteLLM version is patched against CVE-2026-42271. CISA's June 22 deadline applies to federal agencies but is a sound target for any enterprise.
2. Audit the `/user/update` endpoint in your LiteLLM deployment — it should not be reachable by non-admin callers (CVE-2026-47102).
3. Check wildcard API key issuance permissions in your gateway configuration (CVE-2026-47101).
4. Review Copilot Enterprise Search scope settings to confirm whether organizational permission inheritance matches what your security policy actually intends.
5. Pull the callback and tool-call logs from your LiteLLM instance and check for unexpected external calls in the past 30 days.

What Remains Unresolved

Varonis disclosed SearchLeak's mechanism clearly. What is NOT yet clear is whether any real-world exploitation occurred before Microsoft's server-side patch, and Microsoft has not commented publicly on that question as of June 19, 2026.

For the LiteLLM chain, CVSS 9.9 is Obsidian's own assessment. Independent scoring from NVD is pending. Organizations making patch-prioritization decisions based on CVSS scores should flag that the number comes from the disclosing vendor, not a neutral third party. Whether that changes the urgency in practice depends on your environment, but it is a fact worth knowing before you cite the score to a board.