What is the CVSS score of CVE-2026-21229?

CVE-2026-21229 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Power BI Report Server are affected by CVE-2026-21229?

Microsoft Power BI Report Server contains a remote code execution vulnerability (CVE-2026-21229, CVSS 8.8) enabling full system compromise through network-based exploitation.. A patch is available.

How to fix or mitigate CVE-2026-21229?

Within 24 hours, identify and catalog all Microsoft Power BI Report Server instances in your environment and cross-reference against vendor advisory guidance to determine which versions in your deployment are affected. Within 7 days, apply the available vendor patch to non-production Power BI Report Server systems and execute comprehensive testing of critical report functionality and data refresh processes to confirm operational stability. Within 30 days, deploy patches to all production Power BI Report Server instances, confirm all systems run patched versions per vendor guidance, and document remediation completion in your vulnerability tracking system.

Power BI Report Server CVE-2026-21229

HIGH

Improper Input Validation (CWE-20)

2026-02-10 secure@microsoft.com

Information Disclosure Microsoft Power Bi Report Server

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable input validation flaw requires low-privilege authentication (PR:L); full code execution on the vulnerable system yields C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 19, 2026 - 17:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 19, 2026 - 17:22 vuln.today

cvss_changed

CVSS changed

Aug 19, 2026 - 17:22 NVD

8.0 (HIGH) 8.8 (HIGH)

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 18:16 nvd

HIGH 8.0

DescriptionNVD

Improper input validation in Power BI allows an authorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Power BI Report Server exposes organizations to full system compromise via crafted network requests from authenticated low-privileged users. The flaw, rooted in CWE-20 improper input validation, carries a CVSS score of 8.8 with high confidentiality, integrity, and availability impact. Despite the elevated severity score, EPSS sits at just 0.04% (13th percentile) with no KEV listing and no known public exploit, suggesting the vulnerability is currently untargeted rather than actively weaponized.

Technical ContextAI

The affected component is Microsoft Power BI Report Server, an on-premises business intelligence platform derived from SQL Server Reporting Services (SSRS), identified via CPE cpe:2.3:a:microsoft:power_bi_report_server:*:*:*:*:*:*:*:*. The root cause is CWE-20 (Improper Input Validation), meaning the server fails to adequately sanitize or constrain attacker-supplied input before using it in a sensitive operation - a classic precondition for arbitrary code execution. Power BI Report Server exposes network-accessible endpoints for report rendering, data source management, and administrative tasks, any of which could serve as an injection surface. The wildcard CPE version field indicates NVD has not yet bounded the affected version range to specific releases.

RemediationAI

Apply the vendor-released patch as directed by the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21229. An exact patched version number is not confirmed from available data - administrators must consult the MSRC advisory to identify the correct update package. As compensating controls pending patching, restrict network access to Power BI Report Server to trusted internal segments only, blocking any internet-facing exposure at the perimeter firewall (trade-off: reduces external accessibility for remote users). Enforce the principle of least privilege for all report server accounts to limit which authenticated users can reach vulnerable endpoints (trade-off: may restrict legitimate self-service BI workflows). Enable audit logging on the report server to detect anomalous authenticated request patterns. Note that the tags reference 'Information Disclosure' alongside RCE, so data exfiltration risk should also be considered in scope.