CVE-2026-26139
Published: 19 March 2026
Summary
CVE-2026-26139 is a high-severity SSRF (CWE-918) vulnerability in Microsoft Purview. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SC-7 (Boundary Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates SSRF by validating and sanitizing untrusted inputs used to construct server-side requests, preventing forged network access.
Enforces information flow policies to block unauthorized server-initiated requests to internal resources targeted by SSRF exploitation.
Implements boundary protections and monitoring to restrict and identify SSRF attempts accessing sensitive network resources.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF in an internet-facing Microsoft Purview service is directly exploitable remotely with no auth/UI required, mapping to initial access via public-facing application exploitation (T1190); high confidentiality impact and scope change are consistent with post-exploitation data access but no other techniques are directly enabled by the vuln description itself.
NVD Description
Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network.
Deeper analysisAI
CVE-2026-26139 is a server-side request forgery (SSRF) vulnerability, classified under CWE-918, affecting Microsoft Purview. Published on 2026-03-19T21:17:08.377, it carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), indicating high severity due to network accessibility, low attack complexity, no privileges or user interaction required, and a scope change with high confidentiality impact.
An unauthorized attacker (PR:N) can exploit this vulnerability remotely over the network (AV:N) without user interaction. Exploitation enables privilege elevation over a network, potentially allowing access to sensitive data as indicated by the high confidentiality impact and changed scope.
Microsoft's advisory provides details on mitigation, available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26139.
Details
- CWE(s)