CVE-2026-65811: Power BI RCE Vulnerability

CVE-2026-65811 Overview

CVE-2026-65811 is an improper input validation vulnerability in Microsoft Power BI that allows an authorized attacker to execute code over a network. The flaw is classified under [CWE-20] Improper Input Validation and carries a CVSS 3.1 score of 8.8. Successful exploitation compromises confidentiality, integrity, and availability of the affected Power BI service.

Microsoft published the advisory on August 11, 2026. Attackers with low-privilege authenticated access to Power BI can send crafted input over the network to trigger code execution. The vulnerability requires no user interaction, increasing the risk of automated exploitation against exposed tenants.

Critical Impact
An authorized attacker can execute arbitrary code over the network against Power BI, resulting in high impact to confidentiality, integrity, and availability.

Affected Products

Microsoft Power BI (see the Microsoft CVE-2026-65811 Advisory for the authoritative list of affected builds)

Discovery Timeline

2026-08-11 - CVE-2026-65811 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-65811

Vulnerability Analysis

CVE-2026-65811 stems from improper input validation within Microsoft Power BI. The service accepts attacker-controlled input without sufficient validation of type, structure, or content boundaries. This gap allows crafted payloads to reach code paths that interpret or process the data unsafely.

Because the attack vector is network-based and requires only low privileges, any authenticated Power BI user with baseline access can attempt exploitation. No user interaction is required from a victim, which enables scripted or automated attack chains. Successful exploitation yields code execution in the context of the vulnerable Power BI component.

EPSS data as of 2026-08-13 lists an exploitation probability of 0.514% at the 41st percentile. No public proof-of-concept, exploit code, or CISA KEV listing has been observed at time of publication.

Root Cause

The root cause maps to [CWE-20] Improper Input Validation. Power BI does not adequately verify untrusted input before it reaches downstream processing logic. Missing or incomplete validation checks allow malformed or unexpected data to influence execution flow.

Attack Vector

An attacker authenticates to Power BI with low-privilege credentials, then sends a crafted request over the network to a vulnerable endpoint. The malformed input bypasses validation and reaches a component that processes the data in a way that permits code execution. See the Microsoft CVE-2026-65811 Advisory for technical details specific to the affected component.

No verified exploit code is publicly available. Refer to the vendor advisory for authoritative technical guidance.

Detection Methods for CVE-2026-65811

Indicators of Compromise

Unexpected outbound network connections from Power BI service hosts following authenticated user activity.
Anomalous process execution or child processes spawned by Power BI service components.
Authenticated Power BI API requests containing malformed payloads or unusual content types.

Detection Strategies

Monitor Power BI audit logs for unusual API calls from low-privilege accounts, especially those targeting data import, dataset refresh, or custom visual endpoints.
Correlate Microsoft 365 sign-in logs with Power BI activity to identify compromised or abused accounts issuing unexpected requests.
Alert on process-chain anomalies where Power BI service processes launch scripting hosts, shells, or network utilities.

Monitoring Recommendations

Ingest Power BI, Entra ID, and Microsoft 365 audit telemetry into a centralized SIEM for correlation with endpoint activity.
Baseline normal Power BI usage per user and tenant, then alert on statistically significant deviations in query volume, dataset access, or API surface.
Review privileged role assignments and workspace permissions to ensure least-privilege access to Power BI resources.

How to Mitigate CVE-2026-65811

Immediate Actions Required

Apply the security update referenced in the Microsoft CVE-2026-65811 Advisory as soon as it is available for your deployment model.
Audit Power BI user and service principal accounts, disabling any that are unused or over-privileged.
Enforce multi-factor authentication on all accounts with access to Power BI to reduce the risk of credential-based exploitation.

Patch Information

Microsoft addresses CVE-2026-65811 through updates delivered via the Microsoft Security Response Center. For Power BI cloud service, remediation is applied by Microsoft to the affected service tier. For on-premises components such as Power BI Report Server, administrators must install the vendor-supplied update. Consult the Microsoft CVE-2026-65811 Advisory for specific build numbers and installation guidance.

Workarounds

Restrict Power BI tenant access to trusted networks using Conditional Access policies until patching is confirmed.
Limit workspace membership and dataset access to the minimum required set of users to reduce the pool of accounts that can attempt exploitation.
Disable or restrict custom visuals and third-party connectors that accept untrusted input where feasible.

bash

# Example: enforce Conditional Access to Power BI via Microsoft Graph PowerShell
Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess"
# Review existing policies scoped to the Power BI Service application ID
Get-MgIdentityConditionalAccessPolicy | Where-Object {
    $_.Conditions.Applications.IncludeApplications -contains "00000009-0000-0000-c000-000000000000"
}