Microsoft Purview is vulnerable to a server‑side request forgery that allows an unauthenticated attacker to trigger the service to make outbound requests, potentially giving the attacker the ability to reach internal resources and elevate privileges, which aligns with CWE‑918.

All deployments of Microsoft Purview, also known as Office Purview, are potentially affected because the CVE entry does not list specific version constraints.

The flaw carries a CVSS score of 8.6 and an EPSS score of less than 1 %, indicating high severity but low likelihood of exploitation; the vulnerability is not listed in CISA’s KEV catalog, and while no public exploit has been reported, the typical exploitation path would involve crafting requests that cause Purview to resolve arbitrary URLs – a mechanism that is inferred from the description of a server‑side request forgery.