# CVE-2026-21520: CVE-2026-21520: Microsoft Copilot Studio Indirect Prompt Injection ("ShareLeak")

> CVE-2026-21520 is a high-severity prompt injection issue in Copilot Studio, an AI agent. Affected: Copilot Studio (pre-Jan 15 2026 patch).

- **Canonical URL:** https://catalog.anomity.ai/vuln/cve-2026-21520
- **Aliases:** ti-008
- **Severity:** high
- **Attack type:** Prompt injection, Data exfiltration
- **Component:** Copilot Studio (AI agent)
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-01-17
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/cve-2026-21520

## Summary

Copilot Studio concatenated SharePoint form input directly into the agent's system prompt with no sanitization, allowing an attacker filling a public comment field to inject a fake system-role message that overrode agent instructions and directed it to exfiltrate SharePoint customer data via Outlook. Discovered by Capsule Security; Microsoft patched January 15, 2026, though data had already been exfiltrated during the disclosure window.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| Copilot Studio (pre-Jan 15 2026 patch) | no fixed version listed |

## Am I affected by CVE-2026-21520?

You are affected if you run Copilot Studio (pre-Jan 15 2026 patch).

## How do I fix CVE-2026-21520?

Apply Microsoft January 2026 security update. Audit SharePoint forms for injected content. Review Copilot Studio agent configurations for missing input sanitization.

## How do I find every machine running Copilot Studio?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Copilot Studio and which version, then enforce a policy on it.

## References

- cve: https://nvd.nist.gov/vuln/detail/CVE-2026-21520

## Related vulnerabilities

- [cryptographic-context-injection-an-encrypted-web-page-got-github](https://catalog.anomity.ai/vuln/cryptographic-context-injection-an-encrypted-web-page-got-github) — medium
- [salesbleed-zero-click-data-exfiltration-from-salesforce-agentforce-via](https://catalog.anomity.ai/vuln/salesbleed-zero-click-data-exfiltration-from-salesforce-agentforce-via) — high
- [CVE-2026-24301](https://catalog.anomity.ai/vuln/cve-2026-24301) — high
- [ghostjacking-a-firewall-block-log-is-an-injection-channel-because-the](https://catalog.anomity.ai/vuln/ghostjacking-a-firewall-block-log-is-an-injection-channel-because-the) — high
- [rovoblast-one-link-makes-atlassian-rovo-exfiltrate-jira-and-confluence](https://catalog.anomity.ai/vuln/rovoblast-one-link-makes-atlassian-rovo-exfiltrate-jira-and-confluence) — high
- [comment-and-control-claude-code-gemini-cli-copilot-agents-vulnerable-to](https://catalog.anomity.ai/vuln/comment-and-control-claude-code-gemini-cli-copilot-agents-vulnerable-to) — critical

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=cve-2026-21520