CVE-2026-57106
A server‑side request forgery (SSRF) flaw in Data Quality lets an attacker send requests to internal systems, potentially gaining elevated privileges. The vulnerability is critical because it can be exploited remotely without authentication and can change the scope of the affected system.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
No specific product versions are listed in the data; the vulnerability is reported for Data Quality, but no CPEs are provided.
Real-world impact
An attacker could use the flaw to reach internal services, exfiltrate data, or gain higher privileges on the affected system.
Why this severity
The CVSS score of 10 reflects that the flaw is exploitable over the network (AV:N), requires no user interaction (UI:N), has low attack complexity (AC:L), and no privileges are needed (PR:N). It also changes the scope (S:C) and can compromise confidentiality, integrity, and availability (C:H/I:H/A:H).
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 24, 2026 · 8d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 29, 2026 · 3d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- msrc.microsoft.com/update-guide/vulnerability/…vendor advisory