EUVD-2026-54313
GHSA-v9wr-f2rq-j29p
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible service, low complexity, requiring only low-privilege tenant authentication; full CIA impact on eDiscovery service contents upon successful privilege escalation.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Privilege escalation in Microsoft Purview eDiscovery enables an authenticated low-privileged attacker to gain elevated access over the network, with full confidentiality, integrity, and availability impact once exploited. The vulnerability stems from improper access control (CWE-284), meaning the service fails to enforce authorization boundaries between privilege levels for eDiscovery operations such as case management, legal holds, and content searches. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis, though the low attack complexity and network accessibility make this a credible threat in Microsoft 365 enterprise environments.
Technical ContextAI
Microsoft Purview eDiscovery is a compliance and legal investigation platform within the Microsoft 365 ecosystem, enabling organizations to search, hold, and export content for legal proceedings. The CWE-284 (Improper Access Control) root cause indicates the application does not adequately restrict access to privileged operations or data based on the caller's role or permission level. In access control flaws of this class, the service may accept requests for high-privilege actions from authenticated but lower-privileged principals without proper authorization checks - a logic-level bypass rather than a memory corruption or injection flaw. The CVSS vector confirms the attack path is entirely network-based (AV:N), requires no user interaction (UI:N), and demands only low-privilege authentication (PR:L), consistent with an attacker holding a standard Microsoft 365 user or limited eDiscovery role.
RemediationAI
Organizations should consult the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65668 for the authoritative patch guidance, as no specific fixed version number was included in the available intelligence data. Microsoft typically delivers fixes for cloud-hosted Purview services via automatic service updates, which may not require customer action; verify with MSRC whether manual patching or tenant-side configuration changes are required. As a compensating control pending patch confirmation, restrict eDiscovery role assignments to only those users with a documented business need, leveraging Microsoft Purview's built-in role-based access control to minimize the pool of accounts that could be used to trigger this vulnerability. Additionally, enable Microsoft Entra ID Conditional Access policies to require multi-factor authentication for all accounts holding eDiscovery roles, which raises the cost of credential abuse. Monitor audit logs in the Microsoft Purview compliance portal for anomalous privilege usage patterns. Note that role restriction reduces attack surface but does not eliminate the underlying access control flaw.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today