MSRC-CVE-2026-21229 — Power BI Remote Code Execution Vulnerability

Summary

Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.

Details

What privileges could be gained by an attacker who successfully exploited the vulnerability?
An attacker who successfully exploited this vulnerability could gain the privileges of the authenticated user.

Security updates
1.25.9508.3237 — https://learn.microsoft.com/en-us/power-bi/report-server/changelog

Vulnerabilities 1

High 8.0

CVE-2026-21229

Power BI Remote Code Execution Vulnerability

Improper input validation in Power BI allows an authorized attacker to execute code over a network.

Microsoft Power BI Report Server

Feb 10, 2026

Revision history

2026-08-19 #2
Corrected the Power BI Report Server version in the Security Updates table to use the public release version instead of the internal build number. This is an informational change only.
2026-02-10 #1
Information published.

References

CVE-2026-21229 Power BI Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21229
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss