Cyber Resilience

CVE-2026-26138

High

Published: 19 March 2026

Published
19 March 2026
Modified
24 March 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS Score 0.0057 42.6th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-26138 is a high-severity SSRF (CWE-918) vulnerability in Microsoft Purview. Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2026-26138 is a server-side request forgery (SSRF) vulnerability, mapped to CWE-918, in Microsoft Purview. Published on 2026-03-19T21:17:08.217, it carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), reflecting high severity from its network vector, low attack complexity, lack of required privileges or user interaction, changed scope, and high confidentiality impact.

An unauthorized attacker can exploit this SSRF flaw remotely over the network without prior privileges. Successful exploitation enables privilege elevation within the affected Microsoft Purview environment.

Mitigation guidance is available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26138.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability details

Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network.

CWE(s)
CWE-918

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

SSRF in public-facing Microsoft Purview service directly matches remote unauthenticated exploitation of a public app (T1190); explicit outcome of privilege elevation within the environment matches exploitation for privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-26139Same product: Microsoft Purview
CVE-2025-21385Same product: Microsoft Purview
CVE-2025-53762Same product: Microsoft Purview
CVE-2025-21177Same vendor: Microsoft
CVE-2025-59503Same vendor: Microsoft
CVE-2025-62207Same vendor: Microsoft
CVE-2026-32169Same vendor: Microsoft
CVE-2026-32186Same vendor: Microsoft
CVE-2026-26137Same vendor: Microsoft
CVE-2026-33107Same vendor: Microsoft

Affected Assets

microsoft
purview
all versions

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly mitigates SSRF by validating untrusted inputs such as URLs to prevent attackers from forging server-side requests to unauthorized resources.

AC-4 Information Flow Enforcement good match
prevent

Enforces information flow control policies to restrict server-initiated requests to only approved destinations, blocking SSRF exploitation paths.

SC-7 Boundary Protection partial match
preventdetect

Monitors and controls communications at system boundaries to prevent or detect unauthorized outbound requests triggered by SSRF in Microsoft Purview.

References