The vulnerability is a server‑side request forgery that allows an attacker with unauthorized access to send crafted HTTP requests to internal resources within the Microsoft Purview eDiscovery service. This flaw can lead to privilege escalation, allowing the attacker to gain higher level permissions than permitted by their original credentials. The weakness corresponds to CWE‑918, a form of SSRF.

Microsoft Purview eDiscovery is the affected product. The vulnerability applies to all installed versions for which the vendor has not yet released an update, as no specific version range is provided in the CNA data. Users should check the Microsoft Security Update Guide for the latest fix.

The CVSS score of 8.6 indicates high severity. The EPSS score of less than 1 % suggests that the probability of exploitation in the wild is low at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the flaw can be exploited remotely if the Purview service is reachable from the attacker’s network, enabling an elevation of privilege. An attacker would need to craft a request that causes the service to fetch a resource internally, thereby bypassing authentication checks.