Server-Side Request Forgery Vulnerability in Microsoft Purview
CVE-2026-26138

8.6HIGH

Key Information:

Vendor

Microsoft
Status
Microsoft Purview
Vendor
CVE Published:
19 March 2026

What is CVE-2026-26138?

A server-side request forgery vulnerability in Microsoft Purview can allow an attacker to manipulate server-side requests, potentially leading to unauthorized access and privilege escalation within the network. Attackers may exploit this weakness to execute commands remotely or access sensitive internal resources that should otherwise be protected.

Affected Version(s)

Microsoft Purview -

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.