CVE-2026-26150: Microsoft Purview eDiscovery SSRF Elevation of Privilege
CVE-2026-26150 is a server-side request forgery (SSRF) issue in Microsoft Purview eDiscovery that, according to the record, allows an unauthorized attacker over the network to elevate privileges. NVD rates it 10.0 (critical), while the Microsoft-associated scores in the record are 8.6. The record shows no KEV listing and no confirmed exploitation in the sources consulted.
Overview
The record describes CVE-2026-26150 as a server-side request forgery issue in Microsoft Purview eDiscovery that allows privilege elevation over a network. It is classified as CWE-918. It links a Microsoft Security Response Center advisory, but the record itself adds few technical details.
Impact
- The record states that an unauthorized attacker could elevate privileges over a network.
- NVD scores the issue 10.0 (critical). The Microsoft-associated scores in the record are 8.6.
- SSVC fields in the record indicate total technical impact, automatable exploitation, and exploitation status none.
Affected products and versions
- Product listed: Microsoft Purview Ediscovery.
- The source does not specify affected version ranges, and the record contains no version numbers.
- The record lists no fixed versions. This does not mean no fix exists. Consult the vendor advisory for the applicable update.
Exploitation status
- The record shows the vulnerability is not listed in CISA KEV.
- No confirmed exploitation appears in the sources consulted.
- EPSS in the record is 0.01084 (probability) and 0.64975 (percentile).
Remediation and mitigation
- Review the Microsoft Security Response Center advisory for the applicable update and guidance.
- Apply the vendor update to Microsoft Purview eDiscovery deployments as soon as it is confirmed for your environment.
- Until patched, restrict network reachability to eDiscovery functions and limit administrative roles to trusted personnel, following least privilege.
- Where feasible, reduce the ability of the service to make outbound requests to internal destinations.
Detection guidance
- Review audit and sign-in logs for unexpected privilege or role changes related to eDiscovery.
- Monitor for server-side requests from Purview components toward internal network destinations that do not match normal operations.
- Alert on anomalous administrative activity within eDiscovery cases.
Limitations of the available information
- The record does not describe the vulnerable component, the request path, or the preconditions for exploitation.
- Affected and fixed version ranges are not provided.
- The NVD score (10.0) and the Microsoft-associated score (8.6) differ, and the record does not explain the difference.
- The EPSS date in the record is later than the publication date, so the EPSS values should be interpreted with caution.
Frequently asked questions
What is CVE-2026-26150?
It is a server-side request forgery issue in Microsoft Purview eDiscovery that, according to the record, allows an unauthorized attacker over the network to elevate privileges.
Is this vulnerability being actively exploited?
The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
Which versions are affected and is there a fix?
The source does not specify affected version ranges and the record lists no fixed versions. Check the Microsoft advisory for the applicable update.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.