CVE-2026-26150 is a server-side request forgery (CWE-918) vulnerability affecting Microsoft Purview eDiscovery. It enables an attacker without privileges to perform SSRF attacks that can lead to privilege escalation within the network. The vulnerability is rated high severity with a CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N). Microsoft has released an official patch to remediate this vulnerability. The product is not a cloud service, so remediation requires applying the vendor's patch. No known active exploitation has been reported.

Successful exploitation of this SSRF vulnerability could allow an attacker to elevate privileges over the network, potentially gaining unauthorized access to sensitive resources or systems. The confidentiality impact is high, while integrity and availability impacts are not indicated. There are no reports of active exploitation in the wild.

An official fix is available from Microsoft. Users and administrators should apply the vendor-provided patch as detailed in the Microsoft security update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26150) to remediate this vulnerability. Since this is not a cloud service, patching the affected software is required to mitigate the risk.