High MSRC-CVE-2021-26859 1 CVE

Microsoft Power BI Information Disclosure Vulnerability

Published Mar 9, 2021 · Updated Aug 19, 2026 · Revision 2

Vendor: Microsoft

Summary

Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What type of information could be disclosed by this vulnerability?
Exploiting this vulnerability could allow the disclosure of NTLM hashes.

Security updates
1.8.7485.35104 — https://support.microsoft.com/help/5001284
1.9.7675.15620 — https://support.microsoft.com/help/5001285

Vulnerabilities 1

High 7.7

CVE-2021-26859

Microsoft Power BI Information Disclosure Vulnerability

Microsoft Power BI Information Disclosure Vulnerability

Microsoft Power BI Report Server version 15.0.1104.300 Power BI Report Server version 15.0.1103.234

Mar 11, 2021

Revision history

2026-08-19 #2
Corrected the Power BI Report Server version in the Security Updates table to use the public release version instead of the internal build number. This is an informational change only.
2021-03-09 #1
Information published.

References

CVE-2021-26859 Microsoft Power BI Information Disclosure Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26859
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss