What is the CVSS score of CVE-2026-26139?

CVE-2026-26139 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Microsoft are affected by CVE-2026-26139?

A critical vulnerability in Microsoft Purview (CVE-2026-26139) enables attackers to bypass security controls and escalate privileges across your network without authentication.. A patch is available.

How to fix or mitigate CVE-2026-26139?

Within 24 hours: Identify all Microsoft Purview instances in your environment and restrict network access to trusted internal networks only; document current user accounts with Purview access. Within 7 days: Implement enhanced monitoring and logging for Purview API calls and authentication attempts; conduct a privilege audit of all Purview administrative accounts. Within 30 days: Evaluate alternative data governance solutions or request vendor timeline for patch availability; implement network segmentation to isolate Purview infrastructure from critical systems.

Microsoft CVE-2026-26139

EUVD-2026-13186 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-19 secure@microsoft.com

SSRF Microsoft

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 19, 2026 - 21:30 euvd

EUVD-2026-13186

Analysis Generated

Mar 19, 2026 - 21:30 vuln.today

CVE Published

Mar 19, 2026 - 21:17 nvd

HIGH 8.6

DescriptionCVE.org

Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network.

AnalysisAI

Microsoft Purview is vulnerable to server-side request forgery (SSRF) that enables unauthenticated remote attackers to escalate privileges across network boundaries. This network-accessible vulnerability requires no user interaction and impacts the confidentiality of affected systems. No patch is currently available.

Technical ContextAI

This vulnerability affects Microsoft Purview, Microsoft's data governance and compliance platform used for managing and protecting enterprise data across cloud and on-premises environments. The issue is classified as CWE-918 (Server-Side Request Forgery), which occurs when a web application fetches remote resources without validating user-supplied URLs, allowing attackers to make the server perform requests to arbitrary destinations. The SSRF vulnerability in Purview could allow attackers to bypass network segmentation and access internal services that would normally be inaccessible from the internet.

RemediationAI

Organizations should immediately check the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26139 for available security updates and apply them according to Microsoft's guidance. As an interim mitigation, restrict network access to Purview instances using firewall rules or network segmentation to limit exposure to trusted IP ranges only. Additionally, implement robust monitoring for unusual outbound requests from Purview servers that could indicate SSRF exploitation attempts, and ensure proper input validation and URL whitelisting are configured where possible.