# CVE-2026-57106: Microsoft Purview Data Governance SSRF in Data Quality

Source: https://junglewise.ai/threats/cve-2026-57106-microsoft-purview-data-governance-ssrf-in-data-quality  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-24. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-57106 · Severity: critical · CVSS 10 · Published 2026-07-24

A critical security vulnerability has been identified in Microsoft Purview Data Governance, a service used by organizations to manage and improve the quality of their data assets. An unauthorized attacker could exploit this flaw to gain elevated administrative privileges over the network. This could lead to a total compromise of the data governance environment, allowing unauthorized access to sensitive information or disruption of data management operations.

Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-57106 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57106 being exploited in the wild.

**How severe is CVE-2026-57106?** Critical severity, with a CVSS score of 10, published 24 July 2026.

**Which products and versions are affected?** Microsoft Purview Data Governance Data Quality component.

**Is there a fix for CVE-2026-57106?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-57106 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-57106?** Check whether you run Microsoft Purview Data Governance at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the Data Quality component of Microsoft Purview Data Governance. The flaw (CWE-918) allows an unauthenticated attacker to send specially crafted network requests from the server, which can be leveraged to bypass security boundaries and elevate privileges. Given the CVSS score of 10.0 and the 'Changed' scope (S:C), the exploit likely allows the attacker to pivot from the vulnerable service to other internal resources or cloud metadata services to obtain high-level administrative credentials. The vulnerability is exploitable over the network without user interaction. As this is an exclusively hosted service, Microsoft typically manages the deployment of fixes directly to the cloud environment.

## Affected products

- Microsoft Purview Data Governance Data Quality component

## Timeline

- 2026-07-24: disclosed: Initial publication by Microsoft and NVD.

## References

- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57106](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57106)