Microsoft Fabric authentication bypass by spoofing
CVSS 10.0 authentication bypass in Microsoft Fabric. An unauthenticated remote attacker can spoof their identity to bypass authentication and elevate privileges over a network. Patched server-side by Microsoft.
- Vendor
- Microsoft
- Product
- Microsoft Fabric
- CVSS
- 10.0
- EPSS (exploit probability)
- 0.9%
- Status
- patched
- Published
Is CVE-2026-69843 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-69843 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-04 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.9% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-04. Full cross-catalog view: /kev-comparison
CVE-2026-69843 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
CVE-2026-69843 is a CVSS 10.0 (critical) authentication bypass in Microsoft Fabric. An unauthenticated remote attacker can spoof their identity to bypass authentication and elevate privileges over a network. The attack vector is network-accessible; no authentication is required to exploit the flaw.
Microsoft Fabric is an integrated analytics and data platform consolidating Power BI, Data Factory, Synapse Analytics, and OneLake under a single tenant-based service. The spoofing-class bypass affects the platform’s authentication layer at the network perimeter.
Microsoft has patched the vulnerability server-side. No customer-side patch action is required to receive the fix. Organizations should review Fabric workspace access controls and audit logs for anomalous administrative activity from before the patch window, particularly service-principal role grants and workspace-level permission changes.
No exploitation in the wild has been confirmed as of the publication date. The CVE carries no CISA KEV designation.
Sources: MSRC advisory | NVD
Other Microsoft CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-96951 Microsoft Windows Command Injection Vulnerability | [ HIGH ] | 8.8 | 9.8% | |
| CVE-2026-96940 Microsoft Exchange Server privilege escalation via weak authorizationwrite-up | [ HIGH ] | 8.8 | 2.7% | — |
| CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerabilitywrite-up | [ HIGH ] | 8.8 | 8.2% | |
| CVE-2026-85889 Azure AI Foundry missing authentication allows unauthorized privilege escalationwrite-up | [ CRITICAL ] | 10.0 | 0.7% | — |
| CVE-2026-85880 Microsoft Windows ALPC Heap Buffer Overflow Privilege Escalationwrite-up | [ HIGH ] | 7.8 | 0.4% | |
| CVE-2026-81963 Microsoft Windows Update Stack Link-Following Privilege Escalationwrite-up | [ HIGH ] | 7.8 | 0.4% | |
| CVE-2026-62916 Authentication Bypass via Alternate Path in Microsoft Entra IDwrite-up | [ CRITICAL ] | 9.1 | 0.9% | — |
| CVE-2019-1068 Microsoft SQL Server Remote Code Execution Vulnerability | [ HIGH ] | 8.8 | 57.3% |
