Server-Side Request Forgery Vulnerability in Microsoft Purview
CVE-2026-26139

8.6HIGH

Key Information:

Vendor

Microsoft
Status
Microsoft Purview
Vendor
CVE Published:
19 March 2026

What is CVE-2026-26139?

A server-side request forgery (SSRF) vulnerability in Microsoft Purview allows an unauthorized attacker to manipulate requests sent from the server, potentially leading to elevated privileges over a network. This type of attack can enable the exploitation of internal services and resources, posing significant risks to system integrity and data security. Organizations are encouraged to apply available patches to mitigate the risk associated with this vulnerability.

Affected Version(s)

Microsoft Purview -

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.