EUVD-2026-63620
GHSA-3r75-wcfw-gxm8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Low-privilege network account required; path traversal yields full privilege escalation with no scope change beyond the Fabric application boundary.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Privilege escalation in Microsoft Fabric exploits a relative path traversal flaw (CWE-23) to allow a low-privileged authenticated attacker to gain elevated permissions over the network. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the attack requires only a valid low-privilege account and no user interaction, making it accessible to any tenant user or compromised credential. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privilege Microsoft Fabric account (any authenticated tenant user with at minimum read access to a Fabric workspace). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS rates this 8.8 (High) with a network attack vector, low complexity, and low privilege requirement - signals that any authenticated Fabric user could potentially exploit this without special setup. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch as documented in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63509. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, apply the Microsoft-released patch to all Microsoft Fabric instances and verify deployment completion through MSRC or your update management system. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today