A server‑side request forgery vulnerability in Microsoft Bing permits an attacker to forge requests that the Bing service forwards to arbitrary network destinations. This can lead to tampering with internal resources, such as modifying data, disrupting services, or changing configurations, thereby compromising integrity and availability.

The affected product is Microsoft Bing. Specific affected versions are not listed in the vendor’s advisory, so all deployed instances of Bing should be treated as potentially vulnerable until a patch is issued.

The vulnerability carries a CVSS score of 6.5, indicating moderate severity. Its EPSS score is below 1 %, suggesting that exploitation is currently unlikely. The issue is not listed in the CISA KEV catalog. Because the flaw is server‑side, the likely attack vector involves an attacker sending a specially crafted request to Bing’s publicly exposed interface, which triggers the service to forward the request to an internal address—a typical SSRF exploitation pattern. No publicly available exploit has been identified, and the damage would be confined to the networks reachable from Bing’s infrastructure without additional privilege escalation.