Microsoft Fabric CVE-2026-70178

Exploitation requires a valid, low-privileged authenticated account on the target Microsoft Fabric tenant (PR:L per the CVSS vector). No special configuration, non-default feature toggle, or additional user interaction is required beyond initial authentication (AC:L, UI:N). Limiting factors: the attacker must possess legitimate tenant access, ruling out anonymous external attackers; the SSVC non-automatable designation implies each exploitation likely requires some degree of targeted request crafting rather than fully automated scanning; and organizations that have not provisioned Fabric or that have tightly restricted tenant access are not at risk. Guest or external accounts without Fabric role assignments are unlikely to meet the prerequisite.

The CVSS 8.8 score reflects high technical impact across confidentiality, integrity, and availability with low attack complexity and only low-privilege authentication required, making this a realistic internal threat for any multi-user Fabric tenant. SSVC rates technical impact as total and automatable as no - the non-automatable rating tempers mass-exploitation risk but preserves serious concern for targeted insider-threat and compromised-credential scenarios. EPSS at 0.41% (35th percentile) is low relative to the CVSS severity, consistent with a newly disclosed SaaS-hosted flaw without observed exploitation activity; even a mid-sized municipal IT team in gdynia running a Fabric analytics environment should treat this as urgent given the total technical impact attainable once any low-privileged account is available to an attacker. The gap between CVSS 8.8 and the low EPSS is not unusual for enterprise SaaS privilege escalation flaws, where exploitation requires a foothold inside the tenant rather than open internet scanning.

An attacker with a standard low-privileged Fabric contributor or viewer account sends a crafted API or web request that invokes a privileged administrative operation without triggering an authorization check. Because the CVSS vector specifies low attack complexity and no user interaction, the attacker can directly escalate to a higher role - potentially gaining admin-level access to workspaces, semantic models, Lakehouse data, or underlying data source credentials. No public proof-of-concept code has been identified at the time of this analysis.