CVE-2026-21229
Published: 10 February 2026
Summary
CVE-2026-21229 is a high-severity Improper Input Validation (CWE-20) vulnerability in Microsoft Power Bi Report Server. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires systems to perform validation of all inputs to prevent exploitation of improper input validation vulnerabilities like CVE-2026-21229.
Mandates timely identification, reporting, and remediation of flaws such as this Power BI input validation vulnerability through patching.
Restricts the types and quantities of information inputs to reduce the attack surface for network-based input validation exploits.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper input validation enables remote arbitrary code execution in Power BI (network-accessible, low-priv attacker, user interaction), directly facilitating T1190 (public-facing app exploitation) and T1203 (client application exploitation for code exec).
NVD Description
Improper input validation in Power BI allows an authorized attacker to execute code over a network.
Deeper analysisAI
CVE-2026-21229 is an improper input validation vulnerability (CWE-20) in Power BI. Published on 2026-02-10T18:16:23.453, it carries a CVSS v3.1 base score of 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
The vulnerability enables an authorized attacker with low privileges to execute arbitrary code over a network. Exploitation requires low attack complexity but user interaction, allowing the attacker to achieve high confidentiality, integrity, and availability impacts on the affected system.
Microsoft's advisory provides details on mitigation; see https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21229 for patches and guidance.
Details
- CWE(s)