CVE-2026-26137
Published: 19 March 2026
Summary
CVE-2026-26137 is a critical-severity SSRF (CWE-918) vulnerability in Microsoft 365 Copilot Chat. Its CVSS base score is 9.9 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 11.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2026-26137 by identifying, reporting, and applying patches for the specific SSRF flaw in Microsoft Exchange as guided by MSRC.
Prevents SSRF exploitation in Exchange by validating and sanitizing low-privilege user inputs that trigger unauthorized server-side requests.
Blocks forged internal or unauthorized network requests from the Exchange server via boundary protection controls like firewalls or proxies.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF vuln in public-facing Exchange server is exploited by low-priv authorized users for privilege escalation, mapping directly to T1190 (initial app compromise) and T1068 (priv-esc exploitation).
NVD Description
Server-side request forgery (ssrf) in Microsoft Exchange allows an authorized attacker to elevate privileges over a network.
Deeper analysisAI
CVE-2026-26137 is a server-side request forgery (SSRF) vulnerability, classified under CWE-918, affecting Microsoft Exchange. Published on 2026-03-19, it carries a CVSS v3.1 base score of 9.9, indicating critical severity due to its network accessibility (AV:N), low attack complexity (AC:L), and potential for high impact on confidentiality (C:H) and integrity (I:H) with a changed scope (S:C).
An authorized attacker with low privileges (PR:L) can exploit this SSRF vulnerability over the network without user interaction (UI:N), achieving privilege escalation. Successful exploitation allows the attacker to perform actions beyond their initial permissions, potentially compromising the Exchange server and accessing sensitive data or executing unauthorized operations.
The Microsoft Security Response Center (MSRC) provides detailed guidance on this vulnerability, including patch information and mitigation steps, at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26137. Security practitioners should consult this advisory for deployment instructions and workarounds if applicable.
Details
- CWE(s)