This vulnerability, identified as CWE-918, involves Server-Side Request Forgery in Microsoft Purview eDiscovery. It enables an attacker without privileges to send crafted requests from the vulnerable server, potentially elevating their privileges within the network. The CVSS 3.1 vector indicates the attack can be performed remotely without user interaction and requires no privileges initially. The impact is primarily on confidentiality with high severity. Microsoft has released an official fix to address this vulnerability.

An attacker exploiting this SSRF vulnerability could elevate privileges over the network, potentially accessing or interacting with internal resources that should be protected. The CVSS score of 8.6 reflects a high impact on confidentiality without affecting integrity or availability. There are no reports of active exploitation in the wild at this time.

An official fix is available from Microsoft. Users of Microsoft Purview eDiscovery should apply the vendor-provided patch as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26150. Applying this update will remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.