Microsoft disclosed a critical authentication bypass by spoofing in Microsoft Fabric that lets an unauthenticated, remote attacker elevate privileges; rated CVSS 10.0, the maximum possible score.
What Is It
CVE-2026-69843 is an authentication bypass by spoofing flaw in Microsoft Fabric, classified as CWE-290 (Authentication Bypass by Spoofing). Per Microsoft's description, the vulnerability "allows an unauthorized attacker to elevate privileges over a network."
The CVE was published by Microsoft ([email protected]) and currently carries NVD status "Received," meaning NVD enrichment analysis is still pending.
Why It Matters
The CVSS 3.1 base score is 10.0 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Every exploitability factor is maximally unfavorable to defenders:
- Network attack vector: reachable remotely
- Low attack complexity: no special conditions required
- No privileges required: attacker needs no account
- No user interaction: no victim action needed
- Scope: Changed: impact extends beyond the vulnerable component's security boundary
Impact is High across confidentiality, integrity, and availability. The exploitability subscore is 3.9 (the maximum) and the impact subscore is 6.0. A scope-changed authentication bypass in a data platform means an unauthenticated attacker can potentially reach resources governed by other security authorities.
What's Vulnerable
Microsoft Fabric, all versions (the affected version is listed simply as "-"). Microsoft tagged the CVE exclusively-hosted-service, indicating the vulnerability resides in a Microsoft-operated cloud service rather than in software customers install and run themselves. No affected CPEs have been enumerated in the NVD record.
Patch Status
No CISA KEV entry exists for CVE-2026-69843 in the supplied data; active exploitation is not confirmed by KEV, and no KEV required action or remediation deadline applies.
Because the CVE is tagged as an exclusively hosted service, remediation is generally handled on the service side rather than through customer-applied patches. The supplied source material does not state a fix version, mitigation, or workaround. Consult the MSRC Update Guide entry below for Microsoft's authoritative remediation guidance.
Sources
- NVD, CVE-2026-69843: https://nvd.nist.gov/vuln/detail/CVE-2026-69843
- Microsoft MSRC Update Guide; CVE-2026-69843: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69843
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog