Critical Authentication Bypass Vulnerability Found in Microsoft Fabric

• •CVE-2026-69843 is a CVSS 10.0 authentication bypass vulnerability in Microsoft Fabric.
• •The vulnerability allows exploitation without credentials or user interaction, impacting enterprise data.
• •This is the fifth authentication bypass vulnerability reported in Microsoft services since September 1, 2026.

A critical authentication bypass vulnerability, CVE-2026-69843, has been discovered in Microsoft Fabric, allowing attackers to exploit the system without credentials or user interaction. This CVSS 10.0 vulnerability utilizes a network attack vector and has a scope-changed metric, enabling adversaries to breach security boundaries directly into the analytics and data tier where OneLake stores enterprise data. The vulnerability is classified under CWE-287 (Authentication Bypass by Spoofing) and poses significant risks as it impacts the data itself rather than just access controls. This incident marks the fifth authentication-bypass vulnerability identified in Microsoft services since September 1, 2026, highlighting a concerning trend in the company's security posture. Other related vulnerabilities include CVE-2026-77903 in Microsoft Dataverse, which was published just a day earlier. The vulnerabilities span various Microsoft services, including Azure AD and Azure AI, indicating a widening attack surface. The current status of CVE-2026-69843 is that it has been disclosed but is not yet confirmed to be actively exploited.