CVE-2026-63509

CVE-2026-63509 is a path traversal vulnerability in Microsoft Fabric where an authenticated attacker can escape their security context through manipulated path resolution and reach resources in a different security domain — likely across tenants or into Fabric's control plane. The 'authorized attacker' qualifier is doing critical analytical work here: this isn't a broken authentication boundary, it's exploitation of a path that authenticated users can reach, suggesting developers treated 'you're logged in' as a proxy for 'this input is safe to process.' The vulnerability lives in a workflow where authenticated operations trigger internal service-to-service calls. The attacker manipulates path resolution in a way that breaks out of the caller's context — the internal services are not validating that requests from other Fabric services are constructing paths they intended. This is a classic trust boundary leak between microservices: internal services assuming their callers are constructing paths in good faith. What to pressure-test in your environment: First, determine exactly which authenticated endpoints expose file operations, artifact access, notebook execution paths, or data imports — these are the high-probability locations. Check whether your Fabric deployment has role-based access that constrains which paths a given user's session can reach, or if that check is entirely delegated to individual handlers. If path isolation is only enforced within handlers and not at the service boundary, assume this pattern may exist elsewhere. The CVSS 9.9 suggests the analysts saw cross-tenant reach in the exploit chain — 'network-level privilege escalation' in a multi-tenant SaaS platform implies reaching beyond your own tenant's boundaries. Even if your organization doesn't use Fabric's most privileged roles, examine which authenticated workflows invoke internal services with user-influenced paths. The blast radius depends on whether exploitation requires a specific role (workspace admin, service principal with particular assignments) or any authenticated tenant user can trigger the internal service-to-service call chain. That distinction dramatically changes prioritization. Expect more similar vulnerabilities if Fabric's internal APIs uniformly trust authenticated callers without service-layer path contract enforcement — the code smell (copy-pasted path joining in authenticated handlers) has appeared in Azure DevOps, Dynamics, and SharePoint Online's app model historically.

Reviewed through automated stages and approved by a human before publication.