This vulnerability, identified as CWE-918, involves server-side request forgery in Microsoft Purview eDiscovery. An attacker can leverage this flaw to perform unauthorized network requests, resulting in privilege escalation. The vulnerability is rated high severity with a CVSS 3.1 score of 8.6, indicating network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. Microsoft has published an official fix for this vulnerability, and it is not a cloud service, so remediation must be applied by the user.

An attacker exploiting this SSRF vulnerability can elevate privileges over the network, potentially gaining unauthorized access to sensitive information or internal network resources. The confidentiality impact is high, but integrity and availability impacts are not indicated. No active exploitation in the wild has been reported.

An official fix is available from Microsoft for this vulnerability. Users should apply the patch as provided in the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26150. Since this is not a cloud service, remediation requires user action to update affected systems. No additional mitigation steps are specified by the vendor advisory.