CVE-2026-58647
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability in Power BI allows an authorized attacker to perform spoofing over a network. The flaw is caused by improper neutralization of input during web page generation.
Risk Assessment
An attacker can spoof content in Power BI reports or dashboards, potentially leading to credential theft or user deception. The risk affects all organizations using Power BI with network access.
Recommendation
Apply the security update provided by Microsoft for Power BI immediately. Additionally, implement input filtering and restrict user permissions to the minimum necessary.
Other vulnerabilities in Power BI
See allOriginal NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') in Power BI allows an authorized attacker to perform spoofing over a network.