# CVE-2026-65811: Microsoft Power BI improper input validation RCE

Source: https://junglewise.ai/threats/cve-2026-65811-microsoft-power-bi-improper-input-validation-rce  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-65811 · Severity: high · CVSS 8.8 · Published 2026-08-11

Power BI is Microsoft's business intelligence platform used to analyze and visualize corporate data. An attacker with valid credentials can send specially crafted network requests to execute arbitrary code on affected systems, potentially compromising data integrity, availability, and confidentiality of sensitive business analytics.

Technologies: [Microsoft Power BI Report Server](https://junglewise.ai/threats/technologies/power-bi-report-server). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-65811 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65811 being exploited in the wild.

**How severe is CVE-2026-65811?** High severity, with a CVSS score of 8.8, published 11 August 2026.

**Which products and versions are affected?** Microsoft Power BI <UNKNOWN>.

**Is there a fix for CVE-2026-65811?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-65811 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-65811?** Check whether you run Microsoft Power BI or Microsoft Power BI Report Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper input validation flaw in Power BI that enables remote code execution. An authenticated attacker can craft malicious input that bypasses validation controls and execute arbitrary code on the affected system over the network. The vulnerability requires valid authentication credentials and network access to the Power BI service. Successful exploitation allows an attacker to execute code with the privileges of the Power BI service, potentially leading to complete system compromise. A patch is available from Microsoft.

## Affected products

- Microsoft Power BI <UNKNOWN>

## Timeline

- 2026-08-11: disclosed

## References

- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65811](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65811)

## Related threats

- [Microsoft Power BI Report Server cross-site scripting](https://junglewise.ai/threats/cve-2026-58647-microsoft-power-bi-report-server-cross-site-scripting)
- [Microsoft Power BI improper input validation allows code execution](https://junglewise.ai/threats/cve-2026-21229-microsoft-power-bi-improper-input-validation-allows-code)