CVE-2026-26138: Microsoft Purview SSRF Privilege Escalation Vulnerability
CVE-2026-26138 is a server-side request forgery weakness in Microsoft Purview that, according to its description, lets an unauthorized attacker elevate privileges over a network. NVD scores it 10 (critical), while Microsoft-associated providers list 8.6. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.
Overview
CVE-2026-26138 is recorded as a server-side request forgery (SSRF, CWE-918) issue in Microsoft Purview. The record states that an unauthorized attacker on the network can elevate privileges. The vendor advisory is hosted by the Microsoft Security Response Center.
Impact
- The NVD base score is 10 (critical), with a vector indicating high confidentiality, integrity and availability impact and no privileges or user interaction required.
- Microsoft-associated providers list a score of 8.6 for the same record, so the severity assessment differs between sources.
- The exact impact on a specific deployment depends on configuration, which the sources consulted do not describe.
Affected products and versions
- Product: Microsoft Purview.
- The sources do not specify affected version ranges, and the record lists no fixed versions. Consult the vendor advisory for the authoritative list of affected builds.
Exploitation status
CISA KEV does not list this CVE, and the SSVC exploitation field is recorded as none. No confirmed active exploitation appears in the sources consulted. This assessment may change as new information is published.
Remediation and mitigation
- Review the Microsoft advisory and apply the vendor-provided update for your Microsoft Purview deployment as soon as it is confirmed applicable.
- Limit network exposure of Purview components to trusted segments until patches are validated.
- Restrict outbound network access from Purview services to only the destinations they require, which reduces the reach of SSRF-style abuse.
Detection guidance
- Monitor Purview service logs for unexpected outbound requests to internal addresses or metadata endpoints.
- Alert on privilege changes or new administrative assignments tied to Purview service accounts.
- Correlate unusual network flows originating from Purview hosts with identity and audit events.
Limitations of the available information
The record does not list affected version ranges, fixed versions, or detailed technical conditions. Scores differ between NVD and Microsoft-associated providers. The EPSS values are present in the record but are probabilistic and do not confirm exploitation.
Frequently asked questions
What type of weakness is CVE-2026-26138?
The record classifies it as server-side request forgery, mapped to CWE-918, in Microsoft Purview.
Is this CVE known to be actively exploited?
No. It is not listed in CISA KEV and no confirmed exploitation appears in the sources consulted.
Which versions are affected?
The sources consulted do not specify affected versions, and the record lists no fixed versions. Check the Microsoft advisory for details.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.