This vulnerability, identified as CVE-2026-26138 and classified under CWE-918, affects Microsoft Purview. It involves a server-side request forgery flaw that enables an attacker without privileges to escalate their access across the network. The CVSS 3.1 vector indicates the attack can be performed remotely with low complexity and no user interaction, resulting in a complete confidentiality breach but no integrity or availability impact. Microsoft has released an official fix for this issue, as documented in their security update guide.

An attacker exploiting this SSRF vulnerability can elevate privileges over the network, potentially gaining unauthorized access to sensitive information. The impact is rated high due to the confidentiality breach and the ability to escalate privileges without authentication or user interaction. There are no reported active exploits in the wild currently.

An official fix is available from Microsoft. Users and administrators of Microsoft Purview should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26138 to remediate this vulnerability. No additional mitigation steps are indicated beyond applying the official patch.