Microsoft Fabric
Monthly
Authentication bypass by spoofing in Microsoft Fabric lets unauthenticated network attackers impersonate a trusted identity and elevate privileges, with a scope change indicating the bypass can cross the initial authorization boundary to affect resources or tenants beyond the attacker's own. Microsoft and independent assessment both score this CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting full confidentiality, integrity, and availability impact on the affected multi-tenant analytics service. No public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing) at time of analysis, and because Fabric is a Microsoft-operated SaaS, exposure depends on vendor-side remediation rather than customer patching.
Privilege escalation in Microsoft Fabric exploits a relative path traversal flaw (CWE-23) to allow a low-privileged authenticated attacker to gain elevated permissions over the network. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the attack requires only a valid low-privilege account and no user interaction, making it accessible to any tenant user or compromised credential. Microsoft has released a patch via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Authentication bypass by spoofing in Microsoft Fabric lets unauthenticated network attackers impersonate a trusted identity and elevate privileges, with a scope change indicating the bypass can cross the initial authorization boundary to affect resources or tenants beyond the attacker's own. Microsoft and independent assessment both score this CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting full confidentiality, integrity, and availability impact on the affected multi-tenant analytics service. No public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing) at time of analysis, and because Fabric is a Microsoft-operated SaaS, exposure depends on vendor-side remediation rather than customer patching.
Privilege escalation in Microsoft Fabric exploits a relative path traversal flaw (CWE-23) to allow a low-privileged authenticated attacker to gain elevated permissions over the network. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the attack requires only a valid low-privilege account and no user interaction, making it accessible to any tenant user or compromised credential. Microsoft has released a patch via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.