Microsoft Purview SSRF: Privilege Escalation Risk

The National Vulnerability Database has disclosed CVE-2026-26150, a high-severity Server-Side Request Forgery (SSRF) vulnerability in Microsoft Purview. This flaw, rated 8.6 CVSS, allows an unauthenticated attacker to achieve privilege escalation over a network.

SSRF vulnerabilities are critical because they enable attackers to induce the server-side application to make requests to an arbitrary domain of the attacker’s choosing. In this case, within Microsoft Purview, it means an attacker could potentially access internal resources or services that are otherwise protected by network segmentation or firewalls.

For defenders, this is a clear call to action. An unauthenticated network-based attack leading to privilege escalation is a worst-case scenario. It bypasses authentication mechanisms, granting an attacker a direct path to higher-level access within the environment. Organizations using Microsoft Purview must prioritize patching and closely monitor internal network traffic for anomalous requests originating from Purview instances.