This vulnerability (CVE-2026-58647) in Microsoft Power BI Report Server 1.6.0 is caused by improper neutralization of input during web page generation, classified as CWE-79 (Cross-site Scripting). It enables an attacker with authorized access to conduct spoofing attacks by injecting malicious scripts. The CVSS v3.1 base score is 8.0, indicating high severity, with network attack vector, low attack complexity, and requiring privileges and user interaction. Microsoft has published an official fix for this vulnerability.

Successful exploitation can lead to high impact on confidentiality, integrity, and availability of the affected system. Specifically, it allows an authorized attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to credential theft, session hijacking, or other malicious actions that compromise the system and user data.

An official fix is available from Microsoft for Power BI Report Server version 1.6.0. Users should apply the vendor-provided patch promptly to remediate this vulnerability. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58647 for detailed update instructions.