CVE-2026-65668

Think of Microsoft Purview eDiscovery as a “library back office” where authorized staff find and manage sensitive case materials. This bug is like someone being able to sneak past a door guard with only a low-level badge and then briefly getting access to higher-level areas. If an attacker already has some approved access, they may be able to expand what they can do—potentially increasing exposure and disrupting operations.

This matters if your business uses Microsoft Purview eDiscovery and you have users, integrations, or service access that can authenticate to it with low privileges. The vulnerability requires an attacker to be authenticated/authorized, so it’s not a simple “anyone on the internet” flaw. The risk is mainly present when an attacker can reach Purview eDiscovery through normal network access and has some level of authenticated access.

This is urgent because it’s an elevation of privilege problem in a sensitive eDiscovery workflow, and it has a high severity rating. Security reporting and sustained attention link this issue to the Lazarus group, which raises the likelihood that motivated attackers may target it. Act now to install Microsoft’s remediation rather than waiting.

1. Confirm usage and scope

   • Verify that Microsoft Purview eDiscovery is actively used in your tenant (as opposed to only general Purview features).
   • Identify which identities (staff roles, service accounts, automation, third-party integrations) have access to eDiscovery-related functions.

2. Check for exposure

   • Use the Microsoft MSRC update guide for CVE-2026-65668 to determine whether your current deployed/available Microsoft Purview eDiscovery configuration is covered by the vulnerable state and what “fully remediated” version/build means for your environment.
   • If you manage this via standard Microsoft update/service lifecycle, the practical check is whether you are running the state Microsoft indicates is fixed in the MSRC guidance.

3. Upgrade/patch

   • Follow the MSRC remediation steps from: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65668
   • Apply the fix according to your change-management process (test in a non-production path if you have one; otherwise roll forward with monitoring).

4. Temporary workaround if you cannot patch immediately

   • Reduce the number of accounts and roles that can authenticate to Purview eDiscovery.
   • Use least privilege: remove any access not required for day-to-day eDiscovery work.
   • Increase monitoring around privilege changes and unusual eDiscovery/admin actions by authorized users.

5. What to monitor after the update

   • Audit logs for unexpected permission/role changes related to eDiscovery.
   • Unusual access patterns (new users/services accessing eDiscovery features, unexpected document/case access activity).

Note: This CVE is not listed in the CISA KEV catalog based on the provided findings, so prioritize by the vendor fix guidance and your internal risk assessment—but given the RED verdict, treat it as high priority regardless.

CVE-2026-65668 is a Microsoft Purview eDiscovery Elevation of Privilege vulnerability (CWE-284) with network attack capability. The core mechanism is improper access control that allows an authorized/low-privileged attacker to gain higher privileges over the network, with no user interaction required. Publicly, there is no clear dated press report of exploitation and no public exploit code is on record in the provided findings; however, sustained attention and actor association (Lazarus group) increase threat relevance.

The traffic-light verdict is RED. KEV status: not listed in CISA KEV (per findings). EPSS: 0.4% (predicted likelihood) with a flat trend; this is not the basis for urgency here due to the confirmed-risk posture implied by the RED verdict and the reported sustained attention.