What is the CVSS score of CVE-2026-58647?

CVE-2026-58647 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.5%.

Which versions of Power Bi Report Server are affected by CVE-2026-58647?

Microsoft Power BI Report Server contains a cross-site scripting vulnerability (CVE-2026-58647, CVSS 8.0) that allows authenticated attackers to inject malicious scripts into reports.. A patch is available.

How to fix or mitigate CVE-2026-58647?

Within 24 hours, inventory all Microsoft Power BI Report Server deployments and document current versions. Within 7 days, apply the vendor-released patch to all affected systems, testing first in non-production to ensure stability. Within 30 days, audit access logs and system activity for signs of exploitation, conduct user education on report-based social engineering, and implement principle-of-least-privilege controls for report sharing and viewing permissions.

Power Bi Report Server CVE-2026-58647

EUVD-2026-43780 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-14 microsoft

GHSA-qxvr-2hqj-cxr6

XSS Microsoft Power Bi Report Server

5.4

CVSS 3.1 · NVD

Temporal: 7.0

Severity by source

Vendor (microsoft) PRIMARY

HIGH

qualitative

NVD

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

7.0 HIGH

cvss

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jul 17, 2026 - 02:37 NVD

HIGH MEDIUM

CVSS changed

Jul 17, 2026 - 02:37 NVD

8.0 (HIGH) 5.4 (MEDIUM)

Analysis Generated

Jul 14, 2026 - 17:46 vuln.today

CVE Published

Jul 14, 2026 - 17:05 nvd

HIGH 8.0

DescriptionNVD

Improper neutralization of input during web page generation ('cross-site scripting') in Power BI allows an authorized attacker to perform spoofing over a network.

AnalysisAI

Cross-site scripting (CWE-79) in Microsoft Power BI Report Server lets an authenticated, low-privileged attacker inject script that executes in another user's browser session, enabling spoofing of report content and hijacking of the victim's authenticated context over the network. Exploitation requires a victim to interact with attacker-controlled report content (UI:R). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; a vendor patch is available per the MSRC advisory.