CVE-2026-63509 is a critical (CVSS 9.9) relative path traversal flaw in Microsoft Fabric. An authorized attacker can elevate privileges over the network. The record lists no affected versions, so read Microsoft's update guide entry to see whether you need to take any action.
What's affected
The record names Microsoft Fabric and gives no version list, no fixed version and no further detail. The weakness is CWE-23 (relative path traversal). The vector is network based with low complexity, low privileges, no user interaction and a changed scope, with high impact on confidentiality, integrity and availability.
That is all the record says. It does not state whether the fix is delivered by Microsoft to the service or requires customer action. Do not assume either. The update guide entry for this CVE id is the authority.
How to check if you're exposed
Open the Microsoft update guide entry for the CVE and look for the sections that state affected products, mitigations and customer action. Then confirm which Fabric components your organisation uses, and who holds the workspace and administrator roles. The vector requires an authorized account, so the number of people with access matters.
If Microsoft says no customer action is required, record the date you checked and the wording, so you can show it later.
Whatever the product, a current inventory of what you run is what turns a CVE notice into a quick answer. The Gold page for this CVE tracks how its record changes over time, and the free in-browser dependency scan at gold.safeguard.sh/scan covers the application libraries you ship.
What to do now
- Read Microsoft's entry for this CVE and note any required customer action or version.
- List the Fabric workspaces and capacities you run, and who has access to each.
- Remove access for accounts that no longer need it.
- Review audit logs for unexpected role changes or file operations.
- Set a reminder to recheck the entry, since records often gain detail after first publication.
Why it matters
Path traversal means a request names a file or location using relative segments, and the system follows them out of the folder it should stay in. With low privileges and a changed scope, a small mistake can cross a tenant or component boundary, which is why the score is near the maximum.
The class is CWE-23. The record does not mark this CVE as exploited in the wild and it is not in CISA KEV. Because few details are public, the main discipline is to follow the vendor's guidance and watch for updates.
Quick check
Do I have to patch Fabric myself?
The record does not say. Microsoft's entry should state whether customer action is needed. Check it directly.
Sources
Last reviewed: 18 October 2026.
