High · 8.0 CVE-2026-21229 EUVD-2026-7344GHSA-9h3x-5px3-gfh7

Power BI Remote Code Execution Vulnerability

Published Feb 10, 2026 · Updated Aug 19, 2026 · Assigned by microsoft

Vendor: Microsoft Product: Power BI Report Server

Description

Improper input validation in Power BI allows an authorized attacker to execute code over a network.

Affected products

Vendor	Product	Affected	Fixed
Microsoft	Power BI Report Server	1.6.0 – < 1.25.9508.3237	1.25.9508.3237

Advisories 3

MSRC-CVE-2026-21229 Power BI Remote Code Execution Vulnerability Microsoft Security Response Center · Aug 19, 2026
WID-SEC-2026-0363 Microsoft Power BI: Schwachstelle ermöglicht Erlangen von Benutzerrechten und Codeausführung BSI CERT-Bund (WID) · Feb 10, 2026
NCSC-2026-0055 Kwetsbaarheid verholpen in Microsoft SQL Server NCSC-NL (Netherlands) · Feb 10, 2026

References

Power BI Remote Code Execution Vulnerability vendor-advisory patch