cve 2026 58647

The cve 2026 58647 tag covers Microsoft security guidance for a cross-site scripting (XSS) vulnerability in Power BI Report Server. The issue is rated Important and can allow an authenticated attacker to place deceptive content in another user’s browser session, with spoofing listed as the impact. Microsoft identifies the underlying weakness as CWE-79, involving improper input neutralization during web-page generation. The recommended fix is to update affected Power BI Report Server installations to build 15.0.1121.120 or later, including systems on older release branches. This page is relevant to administrators tracking the July 14, 2026 disclosure, its CVSS 3.1 score of 8.0, and required remediation.