Read the docs
TI-2021-11970 Aliases CVE-2021-31984GHSA-mm9m-8c34-98g3

Power BI Remote Code Execution Vulnerability

Priority MEDIUM 42Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from Microsoft.

Summary

Power BI Remote Code Execution Vulnerability

Why it matters now

EPSS 0.01946 80th percentileScored 2026-11-07
Fix Fixed Power BI Desktop (Microsoft): > 2.94.781.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftPower BI Desktop2.0.0.0 to before > 2.94.781.0> 2.94.781.0Patch availableCNA
  • Power BI Desktop VendorMicrosoft Affected 2.0.0.0 to before > 2.94.781.0 Fixed in > 2.94.781.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:power_bi_report_server:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
  • cpe:2.3:a:microsoft:power_bi_report_server:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft

Remediation

  • Fix · CNA Power BI Desktop (Microsoft) Fixed in > 2.94.781.0

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Remote Code Execution
Exploited
No
Publicly disclosed
No
Exploitability
Exploitation Less Likely
ProductStatusPlan or fix
Power BI DesktopFixed > 2.94.781.0 · Security Update

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-31984
  2. 2026-10-03 Alias added: GHSA-mm9m-8c34-98g3

References

Patch 2

  • TI-2026-46897 Power BI Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2026-17140 Power BI Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2024-29123 Power BI Report Server Spoofing Vulnerability CVSS 3.1HIGH 8.8
  • TI-2021-18191 Power BI Report Server Spoofing Vulnerability CVSS 3.1CRITICAL 9.6
  • TI-2021-08468 Microsoft Power BI Information Disclosure Vulnerability CVSS 3.1HIGH 7.7
  • TI-2019-01046 Cross-site scripting in Microsoft SQL Server 2017 Reporting Services CVSS 3.1MEDIUM 6.1
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences