What is the CVSS score of CVE-2026-26137?

CVE-2026-26137 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.1%.

Which versions of Microsoft are affected by CVE-2026-26137?

CVE-2026-26137 is a high-severity server-side request forgery vulnerability in Microsoft 365 Copilot's Business Chat that allows authorized users to escalate their privileges across network…. A patch is available.

How to fix or mitigate CVE-2026-26137?

Within 24 hours: Identify all users with Microsoft 365 Copilot Business Chat access and document current usage patterns. Within 7 days: Implement network segmentation to restrict Copilot service communication, enforce strict outbound firewall rules, and deploy WAF policies to block suspicious SSRF patterns. Within 30 days: Consider disabling Business Chat features if business requirements permit, enforce conditional access policies limiting Copilot to specific IP ranges, and monitor for exploitation indicators while awaiting vendor patch availability.

Microsoft CVE-2026-26137

EUVD-2026-13184 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-19 secure@microsoft.com

SSRF Microsoft

9.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 19, 2026 - 21:30 euvd

EUVD-2026-13184

Analysis Generated

Mar 19, 2026 - 21:30 vuln.today

CVE Published

Mar 19, 2026 - 21:17 nvd

CRITICAL 9.9

DescriptionCVE.org

Server-side request forgery (ssrf) in Microsoft 365 Copilot's Business Chat allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Microsoft 365 Copilot's Business Chat contains a server-side request forgery vulnerability that allows authenticated users to escalate privileges across network boundaries. An attacker with valid credentials can exploit this flaw to access or manipulate resources beyond their intended authorization level. No patch is currently available, making this a significant risk for organizations using the affected service.

Technical ContextAI

This vulnerability is classified as CWE-918 (Server-Side Request Forgery), which occurs when a web application fetches remote resources without validating user-supplied URLs, allowing attackers to make the server perform requests to arbitrary destinations. In Microsoft 365 Copilot's Business Chat context, this likely involves the AI assistant making API calls or fetching resources based on user input without proper validation. The SSRF vulnerability in this cloud-based collaboration tool could allow attackers to probe internal networks, access metadata services, or interact with other Microsoft 365 services using the server's privileges rather than their own limited permissions.

RemediationAI

Microsoft has published security guidance for CVE-2026-26137 available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26137, which should be consulted for specific patching instructions. As this affects a cloud service, Microsoft will likely deploy fixes automatically to their infrastructure, but administrators should verify their tenant configurations and review any custom integrations with Business Chat. Until confirmation of patch deployment, organizations should monitor Business Chat usage for suspicious activity, restrict access to sensitive resources that Copilot can access, and implement additional authentication requirements for critical operations where possible.