This vulnerability (CVE-2026-26137) is a Server-Side Request Forgery (CWE-918) in Microsoft Exchange Online that enables an attacker with authorized network access to escalate privileges. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, no user interaction, and complete impact on confidentiality and integrity with low impact on availability. The vulnerability is officially published and a patch is available, though no patch links are provided in the data. No known exploitation in the wild has been reported.

Successful exploitation allows an authorized attacker to elevate privileges within the Microsoft Exchange Online environment, potentially leading to full compromise of confidentiality and integrity of data, with some impact on availability. Given the critical CVSS score of 9.9, the vulnerability poses a severe risk if left unpatched.

A patch is available for this vulnerability and should be applied promptly to remediate the issue. Since this is not indicated as a cloud service with vendor-managed remediation, administrators must manually deploy the official fix once available. Monitor vendor advisories for patch release details and apply updates accordingly.