What is the CVSS score of CVE-2026-23652?

CVE-2026-23652 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Power Pages are affected by CVE-2026-23652?

Microsoft Power Pages, a cloud-hosted low-code platform, contains a critical remote code execution vulnerability (CVE-2026-23652, CVSS 9.8) that allows network attackers to execute arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-23652?

Within 24 hours, catalog all Power Pages applications in production and assess which are internet-facing or process sensitive data. Within 7 days, apply patch available per vendor advisory to all Power Pages tenants and validate full deployment. Within 30 days, complete a comprehensive audit of user and application activity logs spanning the vulnerability window to identify any unauthorized access, establish application-level monitoring to detect exploitation attempts, and conduct a full post-incident review with stakeholders on impact and remediation status.

Microsoft Power Pages CVE-2026-23652

EUVD-2026-31508 CRITICAL

Command Injection (CWE-77)

2026-05-22 microsoft

GHSA-j3gf-wx64-3r7p

Command Injection Microsoft Microsoft Power Pages

9.8

CVSS 3.1 · NVD

Temporal: 8.7

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

8.7 HIGH

cvss

vuln.today AI

9.8 CRITICAL

Command injection reachable over the network without auth or interaction (AV:N/AC:L/PR:N/UI:N) yields server-side code execution with total confidentiality, integrity, and availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 23, 2026 - 11:34 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 23, 2026 - 11:22 vuln.today

cvss_changed

CVSS changed

Jul 23, 2026 - 11:22 NVD

10.0 (CRITICAL) 9.8 (CRITICAL)

Analysis Generated

May 22, 2026 - 22:45 vuln.today

DescriptionNVD

Improper neutralization of special elements used in a command ('command injection') in Microsoft Power Pages allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Power Pages allows an unauthorized network attacker to inject and execute arbitrary operating-system commands via improperly neutralized special elements (CWE-77). Because Power Pages is a Microsoft-hosted, low-code website-building SaaS platform, the flaw affects the service surface Microsoft exposes to tenants, and a successful attack yields full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.07%), but the CVSS 9.8 rating and 'total' technical impact make it a high-severity issue.

Technical ContextAI

Microsoft Power Pages is a low-code, cloud-hosted platform (part of the Microsoft Power Platform) used to build externally-facing business websites and portals backed by Dataverse. The root cause is CWE-77, Improper Neutralization of Special Elements used in a Command ('command injection'): user-controllable input reaches a command interpreter or shell-execution context without adequate sanitization, allowing attacker-supplied special characters to break out of the intended data context and be interpreted as commands. The single affected CPE is cpe:2.3:a:microsoft:microsoft_power_pages, indicating the vulnerability lives in the Power Pages application/service itself rather than a customer-authored portal. Command injection of this class typically arises where the platform shells out to underlying OS utilities or passes input into a command string during request processing.

RemediationAI

Patch available per vendor advisory: Microsoft reports a fix is available, and because Power Pages is a Microsoft-hosted service the correction is expected to be applied by Microsoft centrally rather than requiring a customer-installed update - no discrete fixed version number is published in the available data. Consult the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23652 to confirm whether any tenant-side action (for example, updating portal components, the Power Pages runtime, or a management portal setting) is required and to obtain any exact version identifier. As interim compensating controls pending confirmation, restrict and monitor traffic to externally-exposed Power Pages sites, place a WAF in front of portals to filter shell metacharacters and command-injection patterns in request parameters, and review Power Platform audit logs for anomalous request activity; note that aggressive WAF rules can produce false positives against legitimate form input, so tune in monitor mode first. Cross-reference https://vuldb.com/vuln/365292 for supplementary detail.