Read the docs
TI-2021-08468 Aliases CVE-2021-26859GHSA-8ff9-hr9f-57m5

Microsoft Power BI Information Disclosure Vulnerability

Priority MEDIUM 40Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Microsoft. Impact type from Microsoft.

Summary

Microsoft Power BI Information Disclosure Vulnerability

Why it matters now

EPSS 0.03402 88th percentileScored 2026-11-07
Fix Fixed Microsoft: 2 updates

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftPower BI Report Server version 15.0.1103.23415.0.0.0 to before 1.8.7485.351041.8.7485.35104Patch availableCNA
MicrosoftPower BI Report Server version 15.0.1104.30015.0.0.0 to before 1.9.7675.156201.9.7675.15620Patch availableCNA
  • Power BI Report Server version 15.0.1103.234 VendorMicrosoft Affected 15.0.0.0 to before 1.8.7485.35104 Fixed in 1.8.7485.35104 Patch available CNA
  • Power BI Report Server version 15.0.1104.300 VendorMicrosoft Affected 15.0.0.0 to before 1.9.7675.15620 Fixed in 1.9.7675.15620 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:power_bi_report_server:15.0.1103.234:*:*:*:*:*:*:*15.0.1103.234VulnerableMicrosoft
cpe:2.3:a:microsoft:power_bi_report_server:15.0.1104.300:*:*:*:*:*:*:*15.0.1104.300VulnerableMicrosoft
  • cpe:2.3:a:microsoft:power_bi_report_server:15.0.1103.234:*:*:*:*:*:*:* Versions 15.0.1103.234 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:power_bi_report_server:15.0.1104.300:*:*:*:*:*:*:* Versions 15.0.1104.300 Vulnerable ·Microsoft

Remediation

Microsoft 2 updates

  • KB5001285
    Security Update
    • Power BI Report Server version 15.0.1104.300 1.9.7675.15620
  • KB5001284
    Security Update
    • Power BI Report Server version 15.0.1103.234 1.8.7485.35104

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Information Disclosure
Exploited
No
Publicly disclosed
No
Exploitability
Exploitation Less Likely

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-26859
  2. 2026-10-03 Alias added: GHSA-8ff9-hr9f-57m5

References

Patch 2

  • TI-2026-46897 Power BI Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2026-17140 Power BI Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2024-29123 Power BI Report Server Spoofing Vulnerability CVSS 3.1HIGH 8.8
  • TI-2021-18191 Power BI Report Server Spoofing Vulnerability CVSS 3.1CRITICAL 9.6
  • TI-2021-11970 Power BI Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2019-01046 Cross-site scripting in Microsoft SQL Server 2017 Reporting Services CVSS 3.1MEDIUM 6.1
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences