Purview Ediscovery
Monthly
Privilege escalation in Microsoft Purview eDiscovery enables an authenticated low-privileged attacker to gain elevated access over the network, with full confidentiality, integrity, and availability impact once exploited. The vulnerability stems from improper access control (CWE-284), meaning the service fails to enforce authorization boundaries between privilege levels for eDiscovery operations such as case management, legal holds, and content searches. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis, though the low attack complexity and network accessibility make this a credible threat in Microsoft 365 enterprise environments.
Privilege escalation in Microsoft Purview eDiscovery enables an authenticated low-privileged attacker to gain elevated access over the network, with full confidentiality, integrity, and availability impact once exploited. The vulnerability stems from improper access control (CWE-284), meaning the service fails to enforce authorization boundaries between privilege levels for eDiscovery operations such as case management, legal holds, and content searches. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis, though the low attack complexity and network accessibility make this a credible threat in Microsoft 365 enterprise environments.