CVE-2026-26150
Published: 23 April 2026
Summary
CVE-2026-26150 is a high-severity SSRF (CWE-918) vulnerability in Microsoft Purview Ediscovery. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-26150 is a server-side request forgery (SSRF) vulnerability, classified under CWE-918, affecting Microsoft Purview. Published on 2026-04-23, it carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), indicating high severity due to its network accessibility, low attack complexity, lack of prerequisites, and significant confidentiality impact across a changed scope.
An unauthorized attacker with network access can exploit this SSRF flaw without requiring privileges or user interaction. Successful exploitation enables the attacker to elevate privileges by forging requests from the server, potentially accessing internal resources or sensitive data that would otherwise be restricted.
The Microsoft Security Response Center (MSRC) advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26150 provides details on mitigation, including available patches and recommended actions for affected Microsoft Purview deployments.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25304
Vulnerability details
Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF in network-accessible Microsoft Purview directly matches exploitation of a public-facing application (T1190); the described ability to forge server requests for privilege elevation and restricted internal data access matches exploitation for privilege escalation (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CVE-2026-26150 by requiring timely identification, reporting, and correction of the SSRF flaw through application of vendor-provided patches as recommended by MSRC.
Prevents SSRF exploitation in Microsoft Purview by validating user-supplied inputs such as URLs to block forging of unauthorized server-side requests to internal resources.
Monitors and controls communications at external and key internal boundaries to restrict server-forged requests from accessing sensitive internal resources or enabling privilege escalation.