Microsoft Excel XSS Weaponizes Copilot Agent (CVE-2026-26144)
Date: 2026-03-10
Affected: Microsoft Excel XSS Weaponizes Copilot Agent (CVE-2026-26144)
Attack vector: data-exfiltration
Category: real-world
Severity: High
CVE: CVE-2026-26144

XSS flaw in Microsoft Excel causes Copilot Agent mode to exfiltrate data via unintended network egress. Zero-click: victim does not need to open the file -- processing by Copilot Agent in preview pane or automated workflow triggers the attack. CVSS 7.5. Patched March 10, 2026.


Mitigations:

Architectural layers (MAESTRO):