This vulnerability (CVE-2026-26139) is a Server-Side Request Forgery (CWE-918) in Microsoft Purview that enables an unauthorized attacker to perform SSRF attacks, potentially allowing privilege elevation over a network. The CVSS 3.1 score of 8.6 reflects a high impact with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. The vulnerability is officially published and a patch is available from Microsoft. No known exploits have been reported in the wild. The vulnerability is not related to a cloud service, so remediation requires applying the patch provided by Microsoft.

Successful exploitation of this SSRF vulnerability could allow an attacker to elevate privileges over a network, potentially leading to unauthorized access to sensitive information or systems within the affected environment. The confidentiality impact is high, but integrity and availability impacts are not indicated. No known active exploitation has been reported.

A patch is available from Microsoft to remediate this vulnerability. Organizations using Microsoft Purview should apply the official patch promptly to mitigate the risk. Since this is not a cloud service, remediation depends on deploying the patch in the affected environment. There are no vendor advisories indicating that no action is required or that the issue is already mitigated.