CVE-2026-26138
Published: 19 March 2026
Summary
CVE-2026-26138 is a high-severity SSRF (CWE-918) vulnerability in Microsoft Purview. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates SSRF by validating untrusted inputs such as URLs to prevent attackers from forging server-side requests to unauthorized resources.
Enforces information flow control policies to restrict server-initiated requests to only approved destinations, blocking SSRF exploitation paths.
Monitors and controls communications at system boundaries to prevent or detect unauthorized outbound requests triggered by SSRF in Microsoft Purview.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF in public-facing Microsoft Purview service directly matches remote unauthenticated exploitation of a public app (T1190); explicit outcome of privilege elevation within the environment matches exploitation for privilege escalation (T1068).
NVD Description
Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network.
Deeper analysisAI
CVE-2026-26138 is a server-side request forgery (SSRF) vulnerability, mapped to CWE-918, in Microsoft Purview. Published on 2026-03-19T21:17:08.217, it carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), reflecting high severity from its network vector, low attack complexity, lack of required privileges or user interaction, changed scope, and high confidentiality impact.
An unauthorized attacker can exploit this SSRF flaw remotely over the network without prior privileges. Successful exploitation enables privilege elevation within the affected Microsoft Purview environment.
Mitigation guidance is available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26138.
Details
- CWE(s)