A critical relative path traversal vulnerability in Microsoft Fabric permits authenticated attackers to achieve privilege escalation, posing a severe risk to organizational data integrity.

This is a relative path traversal vulnerability (CWE-23) residing within Microsoft Fabric. The CVSS vector (PR:L) confirms that the attacker must be an authenticated user with low privileges to successfully execute this exploit.

The ability for an authenticated attacker to elevate privileges presents a significant risk to the confidentiality, integrity, and availability of data hosted within the Fabric environment. With a CVSS score of 9.9, this vulnerability is classified as critical, as it could allow unauthorized lateral movement or the compromise of sensitive administrative functions.

Immediate Action: Review the official Microsoft Security Response Center (MSRC) update guide to identify and apply the necessary security patches for your specific deployment.

Proactive Monitoring: Monitor access logs for unusual path patterns or attempts to traverse directories outside of expected application boundaries.

Compensating Controls: Ensure that Web Application Firewalls (WAF) are configured to detect and block directory traversal strings in incoming requests.

Public Exploit Available: Unknown

Given the critical nature of this vulnerability and the potential for privilege escalation, administrators should prioritize the application of vendor-supplied patches. Proactive monitoring and strict adherence to the principle of least privilege for authenticated users are essential to limiting the impact until remediation is complete.