Microsoft Security Update Guide · Power Platform
Power BI Remote Code Execution Vulnerability
Published · updated 19 aug 2026
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Power BI Report Server: KBRelease Notes
1.26.9682.1442
- Power BI Report Server: KBRelease Notes
Improper input validation in Power BI allows an authorized attacker to execute code over a network.
What kind of flaw is this?
- CWE-20: Improper Input Validation
Input is not checked well enough before the software uses it.
Key facts
Released
11 aug 2026
Last revised
19 aug 2026 (v1.1)
Impact
Remote Code Execution
Max severity
Important
Weakness
CVSS 3.1
8.8 / 7.7 (base / temporal)
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:CPublicly disclosed
No
Exploited
No
Exploitability assessment
Exploitation Less Likely
Customer action required
Yes
Links
CVSS metrics
| Base score metrics | |
|---|---|
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | Low |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity | High |
| Availability | High |
| Temporal score metrics | |
| Exploit Code Maturity | Unproven |
| Remediation Level | Official Fix |
| Report Confidence | Confirmed |
Affected products and updates
| Product | Update | Build |
|---|---|---|
| Power BI Report Server | KBRelease Notes · Security Update | 1.26.9682.1442 |
FAQ
- How could an attacker exploit this vulnerability?
- An authenticated attacker with low-level access to an affected server could send a specially crafted request to execute code on the server. User interaction is not required.
Revisions
| Version | Date | Note |
|---|---|---|
| 1.1 | 19 aug 2026 | Corrected the Power BI Report Server version in the Security Updates table to use the public release version instead of the internal build number. This is an informational change only. |
| 1 | 11 aug 2026 | Information published. |
What changed in Microsoft 365 this week? →
View at Microsoft → ← All security advisories
Source: Microsoft Security Update Guide. 365Fanatic is not affiliated with Microsoft.
