CVE-2026-58647: Microsoft Power BI Report Server XSS Flaw

CVE-2026-58647 Overview

CVE-2026-58647 is a stored cross-site scripting (XSS) vulnerability affecting Microsoft Power BI Report Server. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. An authenticated attacker can inject malicious script content that executes in another user's browser session, enabling spoofing across a network boundary. Exploitation requires low privileges and user interaction, and the scope change indicates impact beyond the initially vulnerable component.

Critical Impact
An authenticated attacker can inject scripts that execute in victim browsers, enabling spoofing, session-context manipulation, and disclosure of low-sensitivity data across trust boundaries in Power BI Report Server.

Affected Products

Microsoft Power BI Report Server

Discovery Timeline

2026-07-14 - CVE-2026-58647 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-58647

Vulnerability Analysis

The vulnerability is a cross-site scripting weakness in Power BI Report Server. The server fails to properly neutralize special characters and script constructs in input rendered back into generated web pages. When a report, parameter, or metadata field containing attacker-controlled markup is loaded by a legitimate user, the browser executes the embedded script within the Power BI Report Server origin. Because the CVSS vector indicates a changed scope, the injected script can influence resources outside the vulnerable component, such as content rendered in adjacent portal frames or user session context. The primary consequence is spoofing, where victims interact with content that appears authentic but is manipulated by the attacker.

Root Cause

The root cause is missing or insufficient output encoding when user-controlled values are inserted into HTML, attribute, or script contexts during page generation. Input validation on the server side does not remove or escape dangerous characters such as <, >, ", and ', allowing script payloads to survive into rendered responses.

Attack Vector

The attack vector is network based and requires an authenticated attacker with low privileges on Power BI Report Server. The attacker plants a payload in a field that is later rendered to another authenticated user. The victim must interact with the affected report or portal page, which then triggers script execution in their browser. No proof-of-concept exploit is publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified public exploit code exists for this vulnerability. See the Microsoft Security Update CVE-2026-58647 for authoritative technical details.

Detection Methods for CVE-2026-58647

Indicators of Compromise

Report definitions, dataset names, or parameter values containing HTML tags such as <script>, <img onerror=>, or javascript: URIs.
Unexpected outbound requests from user browsers to attacker-controlled domains originating from Power BI Report Server portal pages.
Anomalous session activity or credential reuse tied to Power BI Report Server user accounts shortly after report access.

Detection Strategies

Inspect Power BI Report Server IIS logs for requests containing encoded script fragments in query strings, form fields, or referrer headers.
Review report and dataset metadata for embedded HTML or JavaScript payloads inserted by low-privilege authors.
Correlate authentication events with report rendering activity to identify sessions where injected content may have executed.

Monitoring Recommendations

Enable and centralize Power BI Report Server audit logs and IIS access logs in a SIEM for continuous review.
Monitor for creation or modification of reports by low-privileged accounts, particularly changes containing markup characters.
Alert on browser Content Security Policy violation reports generated by Power BI Report Server origins.

How to Mitigate CVE-2026-58647

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-58647 advisory to all Power BI Report Server instances.
Restrict report authoring permissions to trusted users and audit existing low-privilege accounts with publish rights.
Review recently modified reports and datasets for suspicious HTML or script content and remediate any findings.

Patch Information

Microsoft has published a security update for Power BI Report Server. Refer to the Microsoft Security Update CVE-2026-58647 advisory for the specific build numbers and download packages applicable to your deployment. Apply the update on all report server instances, including standby and disaster recovery nodes.

Workarounds

Enforce a strict Content Security Policy on the Power BI Report Server portal to limit inline script execution.
Require users to access Power BI Report Server through browsers with modern XSS mitigations and same-site cookie enforcement.
Limit network exposure of Power BI Report Server to trusted internal networks or authenticated VPN users until patching is complete.

bash

# Configuration example
# Verify installed Power BI Report Server version on Windows
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\PBIRS\Setup" | Select-Object -Property Version, EditionName