CVE-2026-69843

www.tenable.com • September 18, 2026

Share: View original

Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network.

Published : 2026-09-18

Vector : CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Authentication Bypass Vulnerability Found in Microsoft Fabric A critical authentication bypass vulnerability, CVE-2026-69843, has been discovered in Microsoft Fabric, allowing attackers to exploit the system without credentials or user interaction. This CVSS 10.0 vulnerability utilizes a network attack vector and has a scope-changed metric, enabling adversaries to breach security boundaries directly into the analytics and data tier where OneLake stores enterprise data. The vulnerability is classified under CWE-287 (Authentication Bypass by Spoofing) and poses significant risks as it impacts the data itself rather than just access controls. This incident marks the fifth authentication-bypass vulnerability identified in Microsoft services since September 1, 2026, highlighting a concerning trend in the company's security posture. Other related vulnerabilities include CVE-2026-77903 in Microsoft Dataverse, which was published just a day earlier. The vulnerabilities span various Microsoft services, including Azure AD and Azure AI, indicating a widening attack surface. The current status of CVE-2026-69843 is that it has been disclosed but is not yet confirmed to be actively exploited. 2 sources 65

Extracted Entities

CVEs (1)

Platforms (1)

Microsoft Fabric