What is the CVSS score of CVE-2026-26138?

CVE-2026-26138 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Microsoft are affected by CVE-2026-26138?

A critical vulnerability in Microsoft Purview enables attackers to bypass security controls and gain unauthorized elevated privileges across your network without authentication.. A patch is available.

How to fix or mitigate CVE-2026-26138?

Within 24 hours: Inventory all Microsoft Purview deployments and assess exposure; review access logs for suspicious activity. Within 7 days: Implement network segmentation to restrict Purview server communications; deploy WAF rules to block SSRF patterns; disable Purview features if not business-critical. Within 30 days: Establish continuous monitoring for exploitation attempts; evaluate alternative solutions; plan for emergency patching upon vendor release.

Microsoft CVE-2026-26138

EUVD-2026-13185 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-19 secure@microsoft.com

SSRF Microsoft

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 19, 2026 - 21:30 euvd

EUVD-2026-13185

Analysis Generated

Mar 19, 2026 - 21:30 vuln.today

CVE Published

Mar 19, 2026 - 21:17 nvd

HIGH 8.6

DescriptionCVE.org

Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network.

AnalysisAI

Microsoft Purview contains a server-side request forgery vulnerability that allows unauthenticated remote attackers to escalate privileges across network boundaries. An attacker can exploit this flaw without user interaction to gain unauthorized access to sensitive resources and functionality. No patch is currently available.

Technical ContextAI

This vulnerability is classified as CWE-918 (Server-Side Request Forgery), where the application can be tricked into making unauthorized requests to internal resources or external systems. Microsoft Purview is a unified data governance solution that manages and governs on-premises, multicloud, and software-as-a-service data. The SSRF vulnerability allows attackers to bypass security controls and potentially access sensitive internal resources that should not be directly accessible from the internet. The changed scope (S:C) in the CVSS vector indicates the vulnerability can impact resources beyond the vulnerable component itself.

RemediationAI

Apply the security update from Microsoft when available through the Microsoft Security Response Center update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26138. Until a patch is available, implement network segmentation to restrict access to Microsoft Purview instances from untrusted networks, deploy web application firewalls with SSRF protection rules, and monitor for suspicious outbound requests from Purview servers. Review and restrict any URL input fields or data connectors that could be exploited for SSRF attacks.