What's happening in email security: June 15 – June 21, 2026

One click on Copilot could hand over your mailbox

Varonis disclosed SearchLeak, a vulnerability chain in Microsoft 365 Copilot Enterprise that let an attacker exfiltrate mailbox and file data from a single click on a crafted link. Microsoft fixed it server-side as CVE-2026-42824, so there's no tenant action required, and there's no evidence it was exploited in the wild. That's the good news.

The mechanics are what matter. The chain stitched together a prompt injection, an HTML rendering race condition, and a CSP bypass via Bing SSRF, then exfiltrated data through an allowlisted Bing image-fetch endpoint. The data at risk included emails, calendar invites, SharePoint and OneDrive files, and, critically, one-time MFA codes and password-reset links that were still valid for minutes. An AI assistant sitting on top of the mailbox becomes a silent exfiltration path that never trips a single traditional email control, because the data leaves through channels the tenant already trusts. This is the same lesson as ChatGPhish a few weeks ago, now aimed straight at the inbox.

A WordPress plugin was handing out mail-sending credentials

CVE-2026-4020 is an unauthenticated information-exposure flaw in the Gravity SMTP plugin, which has around 100,000 active installs. A vulnerable REST endpoint could return the API keys, SMTP secrets, and OAuth tokens used for email delivery, covering Amazon SES, Google, Mailjet, Resend, and Zoho. Wordfence says it blocked more than 17 million exploit attempts, with a spike on June 7. Patch to 2.1.5 now if you run it.

Here's why this one should worry email teams specifically. Stolen sending credentials let an attacker send through your legitimate, already-trusted provider, as you. Every check treats the mail as genuinely yours, so it sails through, quietly burns the sending reputation you've spent years building, and muddies your DMARC reporting, all with almost no local trace. Authentication was working exactly as designed and the attacker walked in through the front door with your keys.

Apple is moving Hide My Email to a single domain

Sign in with Apple and iCloud+ Hide My Email addresses are consolidating under `private.icloud.com` later this summer. Legacy addresses keep working, but if you run email programs or gateways, update your validation logic, allowlists, suppression lists, and routing to accept the new domain. One side effect worth noting: a single dedicated domain makes masked addresses easier for sites to spot and block at signup.