High MSRC-CVE-2026-58647 1 CVE

Microsoft PowerBI Report Server Spoofing Vulnerability

Published Jul 14, 2026 · Updated Aug 19, 2026 · Revision 2

Vendor: Microsoft

Summary

Impact: Spoofing. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.

Details

Security updates
1.26.9682.1442 — https://learn.microsoft.com/en-us/power-bi/report-server/changelog

Vulnerabilities 1

High 8.0

CVE-2026-58647

Microsoft PowerBI Report Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Power BI allows an authorized attacker to perform spoofing over a network.

Microsoft Power BI Report Server

Jul 14, 2026

Revision history

2026-08-19 #2
Corrected the Power BI Report Server version in the Security Updates table to use the public release version instead of the internal build number. This is an informational change only.
2026-07-14 #1
Information published.

References

CVE-2026-58647 Microsoft PowerBI Report Server Spoofing Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58647
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss