What is the CVSS score of CVE-2026-26150?

CVE-2026-26150 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Purview are affected by CVE-2026-26150?

Microsoft Purview eDiscovery contains a server-side request forgery vulnerability (CVSS 8.6) permitting remote attackers to escalate privileges and access sensitive eDiscovery data and governance…. A patch is available.

How to fix or mitigate CVE-2026-26150?

Within 24 hours, identify all systems running Microsoft Purview eDiscovery and document their network exposure. Within 7 days, apply the vendor-released patch available per Microsoft security advisory to all production instances. Within 30 days, verify patch deployment completeness, validate eDiscovery workflows and retention operations, and enable audit logging to monitor suspicious access to eDiscovery features.

Microsoft Purview CVE-2026-26150

EUVD-2026-25304 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-23 microsoft

GHSA-cmwj-wrw7-w4jx

SSRF Microsoft Microsoft Purview Ediscovery

8.6

CVSS 3.1 · NVD

Temporal: 7.5

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CIRCL (temporal)

7.5 HIGH

cvss

vuln.today AI

8.6 HIGH

Unauthenticated network-reachable SSRF (AV:N/AC:L/PR:N/UI:N) that crosses a trust boundary (S:C) to disclose data (C:H), with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:35 vuln.today

EUVD ID Assigned

Apr 23, 2026 - 22:15 euvd

EUVD-2026-25304

Patch released

Apr 23, 2026 - 22:15 nvd

Patch available

CVE Published

Apr 23, 2026 - 21:37 nvd

HIGH 8.6

DescriptionCVE.org

Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network.

AnalysisAI

Server-side request forgery in Microsoft Purview eDiscovery lets an unauthorized remote attacker coerce the service into issuing crafted requests to elevate privileges over the network, with a scope-changing confidentiality impact (CVSS 8.6). The flaw is remotely reachable without authentication or user interaction, and Microsoft has issued a fix. There is no public exploit identified at time of analysis, and EPSS (0.06%) rates near-term mass exploitation as low.

Technical ContextAI

Microsoft Purview eDiscovery is a cloud-hosted compliance/data-governance service within the Microsoft 365 / Purview suite used for legal hold, search, and export of organizational content. The root cause is CWE-918 (Server-Side Request Forgery): the service accepts attacker-influenced input that is used to build outbound requests, allowing the server to be tricked into reaching resources it should not - typically internal endpoints, metadata services, or trusted backend systems that then leak data or grant elevated context. The CPE identifies the affected component precisely as cpe:2.3:a:microsoft:microsoft_purview_ediscovery, i.e. the eDiscovery module rather than the entire Purview platform.

RemediationAI

Patch available per vendor advisory (Microsoft MSRC, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26150); no discrete fix version is published because Purview eDiscovery is a Microsoft-operated cloud service, so remediation is expected to be applied server-side by Microsoft without customer action. Administrators should confirm remediation status via the MSRC update guide and their Microsoft 365 message center, verify no exposure notice requires action, and review Purview eDiscovery audit/activity logs for anomalous outbound or search-connector activity. As general hardening while confirming, restrict which administrators hold eDiscovery Manager/Administrator roles and enforce conditional-access and least-privilege on the compliance portal; note this limits blast radius but does not itself remediate a service-side SSRF.