Quick answers
- Is CVE-2026-57106 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-57106 being exploited in the wild.
- How severe is CVE-2026-57106?
- Critical severity, with a CVSS score of 10, published 24 July 2026.
- Which products and versions are affected?
- Microsoft Purview Data Governance Data Quality component.
- Is there a fix for CVE-2026-57106?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-57106 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-57106?
- Check whether you run Microsoft Purview Data Governance at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the Data Quality component of Microsoft Purview Data Governance. The flaw (CWE-918) allows an unauthenticated attacker to send specially crafted network requests from the server, which can be leveraged to bypass security boundaries and elevate privileges. Given the CVSS score of 10.0 and the 'Changed' scope (S:C), the exploit likely allows the attacker to pivot from the vulnerable service to other internal resources or cloud metadata services to obtain high-level administrative credentials. The vulnerability is exploitable over the network without user interaction. As this is an exclusively hosted service, Microsoft typically manages the deployment of fixes directly to the cloud environment.
Affected products
- Microsoft Purview Data Governance Data Quality component
Timeline
- 2026-07-24: disclosed: Initial publication by Microsoft and NVD.