Microsoft Fabric Auth Bypass Reaches CVSS 10.0

Microsoft has patched CVE-2026-69843, a CVSS 10.0 authentication bypass in Microsoft Fabric that allowed an unauthenticated remote attacker to spoof their way to elevated network privileges. The MSRC advisory lists the fix as deployed; Microsoft does not publish specific patch versions because Fabric is a cloud service fixed server-side.

Microsoft Fabric is the company’s integrated analytics platform, which unifies Power BI, Data Factory, Synapse Analytics, and OneLake under a single tenant-based service. It sits in the middle of most enterprises’ data pipelines, with read and write access to sensitive warehouses and lakehouses. CVSS 10.0 on a platform like this is not a number that arrives without consequence.

The NVD entry describes the flaw as authentication bypass by spoofing. The attack vector is network-accessible. No authentication is required. Privilege escalation is the confirmed outcome. Microsoft’s advisory does not elaborate on the bypass mechanism, which is standard practice for vulnerabilities patched server-side: releasing technical detail before customers can verify remediation helps nobody except whoever is planning the next wave of attempts.

What customers don’t get

When Microsoft patches a server-side flaw at this severity, the remediation story is clean. The fix ships to every Fabric tenant at once. No customer action required. In two weeks it is filed under “silently resolved.” The uncomfortable part is the corollary. There are no patch notes to cross-reference, no version string to confirm, and no forensic procedure for determining whether the bypass was used against your tenant before the fix landed. Fabric does not surface the kind of low-level network authentication telemetry that an on-premises identity system would.

That is not a complaint about Microsoft’s approach in particular. It is the structure of infrastructure-as-a-service. Cisco ISE’s CVE-2026-76460 at the same CVSS score, actively exploited and added to CISA’s KEV catalog, landed differently because ISE runs in your environment. You can pull logs, re-image suspect nodes, verify the patch took. With Fabric, you accept that the window is closed on Microsoft’s word. There is a reasonable tradeoff in there somewhere; the difficulty is that the tradeoff is not yours to negotiate after the fact.

Azure AI Foundry received its own CVSS 10.0 fix in the same September window, reported by The Hacker News with the same “no customer action required” posture. Two maximum-severity authentication and privilege escalation flaws patched across Microsoft’s cloud analytics and AI infrastructure in a week is the kind of pattern worth noting, even when the patches are already in.

What to check

Some useful review steps remain available even without visibility into the authentication layer itself.

• Pull Fabric audit log events through the Microsoft Purview portal or the Fabric REST API. Look for anomalous workspace-level administrative actions in the week before September 19: service-principal role grants, workspace member additions, and permission changes are the highest-signal artifacts if a bypass had been used to escalate and establish persistence.
• Review which service principals and external accounts hold contributor-or-higher roles across Fabric workspaces. A CVSS 10.0 spoofing-class bypass opens the door to privilege escalation; if an attacker used it, the most durable outcome would be a persistent access grant.
• Tighten conditional access policies governing Fabric API and portal access. Requiring compliant device status and MFA-resistant authentication methods limits what a spoofing-class attack can accomplish if a similar class of bypass surfaces later.

CVE-2026-69843 carries no CISA KEV designation and no confirmed exploitation. That is the better outcome. But maximum severity on a spoofing authentication bypass in a platform sitting on top of enterprise data means reviewing what Fabric can reach, checking what the audit logs show, and understanding what visibility you do and do not have into how that platform authenticates its callers.

September has been a busy patch month. The September Patch Tuesday roundup and a subsequent out-of-band fix for RDS and Hyper-V covered the on-premises side of the ledger. The cloud-service fixes are quieter, but the severity numbers are the same.