EUVD-2026-63620
GHSA-3r75-wcfw-gxm8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege Fabric credentials
-
DeliveryCraft request with relative path traversal sequences
-
ExploitSend request to Fabric API over network
-
ExecutionApplication resolves path outside authorized boundary
-
PersistAccess or modify high-privilege workspace resources
-
ImpactAchieve full tenant-level privilege escalation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Relative path traversal prevention
|
| Exploitation Conditions | Exploitation requires a valid low-privilege Microsoft Fabric account (any authenticated tenant user with at minimum read access to a Fabric workspace). The attacker must be able to send crafted network requests to the affected Fabric service endpoint - no special network positioning or second victim is needed (AV:N, UI:N). Exploitation is not automatable per SSVC, implying some degree of manual targeting or context-specific crafting is required despite AC:L in CVSS. Limiting factors include the mandatory PR:L authentication requirement - unauthenticated actors cannot exploit this - and the cloud-hosted nature of Fabric, which means Microsoft can patch tenant instances without customer action in many cases. |
| Impact | CVSS rates this 8.8 (High) with a network attack vector, low complexity, and low privilege requirement - signals that any authenticated Fabric user could potentially exploit this without special setup. However, SSVC qualifies 'Automatable: no', which conflicts with the AC:L/PR:L CVSS metrics and suggests some manual or contextual steps are required in practice despite the low stated complexity; this discrepancy should be verified against the vendor advisory. EPSS sits at 0.62% (47th percentile), indicating that despite the high CVSS score, exploitation probability is currently moderate-low and no observed exploitation has been recorded. SSVC labels Technical Impact as 'total', consistent with the C:H/I:H/A:H CVSS impact triad. The combination of no KEV listing, no POC, low EPSS, and SSVC 'Exploitation: none' suggests this is a high-priority patch target for Fabric deployments but not an emergency response scenario as of analysis date. |
| Exploit ScenarioDerived | An attacker with a low-privilege Microsoft Fabric account - such as a Workspace Viewer or a compromised service principal - crafts a network request containing relative path traversal sequences targeting a Fabric API endpoint. The application resolves the malformed path outside the caller's authorized resource boundary, granting the attacker read/write access to objects or workspace resources belonging to higher-privilege roles. No public proof-of-concept has been identified, but the low complexity and authentication barrier make this feasible for any insider or phished credential holder. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 04, 2026
Privilege escalation in Microsoft Fabric exploits a relative path traversal flaw (CWE-23) to allow a low-privileged authenticated attacker to gain elevated permissions over the network. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the attack requires only a valid low-privilege account and no user interaction, making it accessible to any tenant user or compromised credential. Microsoft has released a patch via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Earlier versions of this analysis (1)
Privilege elevation in Microsoft Fabric lets an authenticated, low-privileged user abuse a relative path traversal weakness (CWE-23) over the network to reach resources outside their intended scope and gain higher privileges. Microsoft rates this CVSS 9.9 with a scope change, reflecting that a compromised tenant identity can cross authorization boundaries in the multi-tenant analytics platform. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and low attack complexity make it a high-priority fix.
RemediationAI
Apply the vendor-released patch as documented in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63509. Microsoft Fabric is a cloud-hosted SaaS/PaaS service; patching is generally managed by Microsoft on the backend, but customers should verify their tenant is running the patched version by checking the MSRC advisory for any customer action items. As a compensating control prior to patch confirmation, restrict Fabric workspace access to the minimum required set of users and audit workspace membership to reduce the pool of low-privilege accounts that could exploit the flaw. Enforcing Conditional Access policies to limit Fabric access to managed, compliant devices adds friction for opportunistic exploitation. No workaround eliminates the path traversal root cause.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Microsoft Fabric is a cloud-based unified analytics platform (encompassing Data Factory, Synapse, Power BI, and related services) launched by Microsoft in 2023. The affected CPE (cpe:2.3:a:microsoft:microsoft_fabric:*:*:*:*:*:*:*:*) covers all versions prior to the vendor patch. CWE-23 (Relative Path Traversal) indicates the application constructs a file or resource pathname using attacker-supplied input without adequately neutralizing relative path sequences (e.g., '../'). In a privilege escalation context, this likely allows a low-privilege principal to traverse beyond their authorized resource boundary and access or modify objects belonging to higher-privilege identities or workspace roles, rather than merely disclosing arbitrary files.
Know when Microsoft Fabric gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Low-privilege network account required; path traversal yields full privilege escalation with no scope change beyond the Fabric application boundary.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.
Executive ViewAI
Microsoft Fabric contains a privilege-escalation vulnerability (CVE-2026-63509) that allows any authenticated tenant user to gain elevated permissions over the network without user interaction. While no active exploitation has been observed, the ease of access-requiring only a valid login account-poses a moderate risk to organizations where user credentials may be compromised or shared; the primary concern is lateral movement and unauthorized data access within cloud analytics environments.
Apply vendor patch. Until patching is complete, restrict Fabric access to named users with strong authentication (disable shared or service-account access where feasible) and monitor permission-change audit logs for unauthorized escalations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB