Vulnérabilité d'élévation de privilèges Microsoft Purview

The SSRF vulnerability in Microsoft Purview allows an attacker to craft malicious requests that the Purview service will execute on behalf of the attacker. This can lead to unauthorized access to internal resources, data exfiltration, and potentially even privilege escalation. An attacker could, for example, use this vulnerability to scan internal networks for open ports or access sensitive data stored on internal servers. The blast radius extends to any network resources accessible by the Purview service, potentially impacting multiple systems and data stores. While no direct precedent exists for this specific SSRF, SSRF vulnerabilities generally pose a significant risk due to their ability to bypass security controls and access internal resources.

Organizations heavily reliant on Microsoft Purview for data governance and compliance are at significant risk. Specifically, deployments with extensive network access granted to the Purview service, or those using older versions (1.0.0 and earlier) are particularly vulnerable. Shared hosting environments utilizing Microsoft Purview also face increased risk due to potential cross-tenant exploitation.

• windows / supply-chain:

Get-WinEvent -LogName Application -Filter "EventID = 1000 -Message *= 'Purview SSRF attempt'"

• windows / supply-chain:

Get-Process -Name "PurviewService" | Select-Object -ExpandProperty Path | ForEach-Object { Get-ChildItem $_ -Recurse | Where-Object {$_.Name -like "*.log"} }

• generic web: Use curl or wget to test for SSRF by attempting to access internal resources through the Purview service. For example, curl http://purview-service/http://internal-server.

1. 2026-03-19Disclosure

   disclosure

1. Réservé2026-02-11
2. Publiée2026-03-19
3. Modifiée2026-04-14
4. EPSS mis à jour2026-03-27

The primary mitigation for CVE-2026-26139 is to upgrade Microsoft Purview to version 2.5.4 or later, which includes the necessary fix. If immediate upgrading is not possible, consider implementing temporary workarounds such as restricting network access for the Purview service to only the necessary resources. Implement strict input validation and sanitization to prevent malicious requests from being processed. Consider deploying a Web Application Firewall (WAF) with SSRF protection rules to filter out potentially malicious requests. After upgrading, confirm the fix by attempting to trigger the SSRF vulnerability and verifying that the request is blocked or handled securely.