This vulnerability (CVE-2026-26139) in Microsoft Purview involves a server-side request forgery (CWE-918) that enables an attacker with no privileges and no user interaction to elevate privileges over a network. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, high confidentiality impact, no integrity or availability impact, with a proof-of-concept exploit and an official fix released by Microsoft. The vendor advisory confirms the availability of an official fix. No affected versions are explicitly stated.

Successful exploitation of this SSRF vulnerability can lead to unauthorized privilege elevation over the network, potentially allowing attackers to access or manipulate resources they should not have access to. The confidentiality impact is high, but integrity and availability are not affected. This could lead to significant security breaches if exploited.

An official fix is available from Microsoft. Users and administrators of Microsoft Purview should apply the vendor-provided patch as soon as possible. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26139 for detailed remediation instructions. No additional mitigations are indicated by the vendor advisory.