CVE-2026-26120 Microsoft Bing Tampering Vulnerability
An unauthorized attacker can exploit a server-side request forgery flaw in Microsoft Bing to perform tampering over the network.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-26120?
CVE-2026-26120 is a medium-severity server-side request forgery vulnerability in Microsoft Bing, published on 19 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to perform tampering over a network.
Weakness: CWE-918
Which versions are affected by CVE-2026-26120?
It affects 1 product.
Products include Microsoft Bing.
How do I fix CVE-2026-26120?
No fix has been published for CVE-2026-26120 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-26120 being exploited?
There is no known exploitation of CVE-2026-26120 in the wild and no public exploit code.
Other vulnerabilities in Microsoft Bing
- CVE-2026-33819 Microsoft Bing Remote Code Execution Vulnerability
- CVE-2026-32186 Microsoft Bing Elevation of Privilege Vulnerability
- CVE-2025-21355 Microsoft Bing Remote Code Execution Vulnerability
- CVE-2014-1670 Code injection in n/a
- CVE-2020-1329 Cross-site scripting in Microsoft Bing Search for Android
Sources
Also known as GHSA-5j3j-x96g-89v5.