This vulnerability involves relative path traversal in Microsoft Fabric, enabling an attacker with authorized network access to escalate privileges. The CVSS 3.1 vector indicates it is remotely exploitable with low attack complexity and no user interaction required, affecting confidentiality, integrity, and availability with a critical severity rating. Microsoft has published an official fix to remediate this vulnerability.

An authorized attacker can exploit this relative path traversal vulnerability to elevate privileges on the affected system remotely, potentially leading to full compromise of confidentiality, integrity, and availability of the system running Microsoft Fabric.

Microsoft has released an official fix for this vulnerability. Users should apply the vendor-provided patch as soon as possible to mitigate the risk. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63509 for detailed remediation instructions.