What is the CVSS score of EUVD-2026-56446?

EUVD-2026-56446 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Power BI are affected by EUVD-2026-56446?

Microsoft Power BI contains a remote code execution vulnerability (CVE-2026-65811, CVSS 8.8) allowing low-privileged authenticated users to execute arbitrary code remotely; no public exploit…. A patch is available.

How to fix or mitigate EUVD-2026-56446?

Within 24 hours, conduct an inventory of all Power BI instances and active user accounts, then implement emergency access restrictions limiting Power BI to essential personnel only and enabling comprehensive audit logging. Within 7 days, segment network traffic to isolate Power BI infrastructure from critical systems, enforce multi-factor authentication for all Power BI users, and configure alerts for low-privileged account access to Power BI. Within 30 days, monitor MSRC advisories for patch availability and prepare a deployment and testing plan; conduct a full access review to revoke unnecessary permissions and enforce read-only access for low-privileged accounts where feasible.

Power BI EUVD-2026-56446

| CVE-2026-65811 HIGH

Improper Input Validation (CWE-20)

2026-08-11 secure@microsoft.com

GHSA-jxpp-q6w9-f47h

Information Disclosure Microsoft Power Bi Report Server

8.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable service exploitable with low-privilege credentials and low complexity; full C/I/A impact is consistent with arbitrary code execution, and no scope change is described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 11, 2026 - 18:19 EUVD

Analysis Generated

Aug 11, 2026 - 18:16 vuln.today

CVE Published

Aug 11, 2026 - 17:19 nvd

HIGH 8.8

DescriptionCVE.org

Improper input validation in Power BI allows an authorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Power BI enables low-privileged authenticated attackers to execute arbitrary code over the network via improper input validation (CWE-20). The CVSS 3.1 score of 8.8 (High) reflects full confidentiality, integrity, and availability impact with low attack complexity and no user interaction required beyond holding a valid account. No public exploit code or active exploitation has been identified at time of analysis, though the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65811 should be consulted for patch and scope details.

Technical ContextAI

Microsoft Power BI is a widely-deployed cloud and on-premises business intelligence and data visualization platform. The root cause is CWE-20 (Improper Input Validation), a class of flaws where user-supplied or network-provided input is insufficiently sanitized or validated before being passed to a sensitive processing routine - in this case one capable of triggering code execution. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the vulnerable component is network-accessible and exploitable without elevated privileges or interaction. No CPE strings were provided in the input data; the exact affected Power BI component (Desktop, Service, Report Server, Embedded) is not specified in available intelligence and must be confirmed via the MSRC advisory. It is also worth noting a discrepancy: the vulnerability tag is labeled 'Information Disclosure' while the description states 'execute code' - these may reflect different impact aspects or a tagging error in the source data.

RemediationAI

Apply the Microsoft-released patch as detailed in the MSRC security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65811. Exact fix versions were not provided in the available data; consult that advisory for the specific update to apply. As compensating controls prior to patching, restrict Power BI access to the minimum set of required user accounts and enforce strong authentication (MFA) to raise the bar for credential-based exploitation, since the flaw requires at least low-privilege access (PR:L). Network segmentation limiting which hosts can reach Power BI service endpoints reduces the attack surface against the AV:N vector but does not eliminate risk for legitimate users. Monitor Power BI audit logs for anomalous input patterns or unexpected code execution events.