Improper input validation in Microsoft Power BI Report Server allows an authenticated attacker with necessary permissions to execute arbitrary code on the server. Based on the description, it is inferred that the attacker must be authenticated and possess necessary permissions. The flaw is a classic input validation weakness mapped to CWE‑20. By sending specially crafted requests that the service interprets as executable commands, an attacker can gain full control of the Power BI instance, compromising confidentiality, integrity, and availability.

The vulnerability affects Microsoft Power BI Report Server. The advisory does not list specific affected versions, suggesting that all releases that process request payloads in the described manner may be vulnerable. Organizations should assume all Power BI Report Server deployments are potentially affected until a vendor patch has been applied.

The flaw received a CVSS score of 8, indicating high severity. The EPSS score is less than 1 %, implying that widespread exploitation activity is currently low. The vulnerability is not listed in the CISA KEV catalogue. Exploitation requires an authenticated session with sufficient privileges; based on the description, it is inferred that the attacker must have legitimate credentials, thus the threat surface is limited to insiders or attackers who have compromised legitimate credentials. Due to the high severity, operators should prioritize remediation once the patch is available.