Microsoft Power Apps CVE-2026-26149

Requires authenticated access to Microsoft Power Apps with low-level privileges (PR:L from CVSS vector). Attack depends on user interaction (UI:R) where a legitimate user must process or interact with attacker-controlled input containing malicious escape sequences. Exploitation is network-based (AV:N) with low attack complexity (AC:L), meaning no special network positioning or complex timing is required once authentication and user interaction conditions are met. The vulnerability affects specific Power Apps version 1710 build 9.2.23071.136 and earlier - deployments running patched version 3.26032.10.0 or later are not vulnerable. Limiting factors include the authentication barrier preventing anonymous exploitation, the social engineering component required for user interaction, and the need for attackers to have legitimate access credentials to the target Power Apps environment. Organizations with restricted Power Apps access limited to trusted internal users face lower risk than those exposing Power Apps to broader external or partner user populations.

Real-world risk assessment reveals moderate-to-high priority despite critical CVSS 9.0 score. CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C) indicates network-accessible attack with low complexity but requires authenticated access and user interaction, significantly reducing attack surface compared to unauthenticated vulnerabilities. EPSS score of 0.08% (23rd percentile) suggests security researchers and threat actors have not prioritized this vulnerability for exploitation, likely due to the authentication and user interaction prerequisites. SSVC framework assessment confirms no active exploitation detected, rates as non-automatable (consistent with UI:R requirement), but acknowledges total technical impact potential. The changed scope presents particular concern as successful exploitation can cascade beyond the initial compromise point. Key risk limiters: requires existing authenticated user account, depends on victim user interaction, and targets specific Power Apps deployments rather than ubiquitous infrastructure. Vendor patch availability and low EPSS score suggest this is manageable through standard patch cycles rather than emergency response, though organizations heavily reliant on Power Apps for business-critical workflows should prioritize given the high impact potential.

An authenticated attacker with low-privilege access to a Microsoft Power Apps instance crafts a malicious payload containing escape sequences embedded in input fields or parameters. The attacker social engineers a legitimate user with higher privileges or access to sensitive data to interact with the malicious content through the Power Apps interface. When the victim user processes the crafted input, the improperly neutralized escape sequences manipulate the application's execution context, allowing the attacker to bypass security controls and execute unauthorized operations with the victim's privileges across security boundaries, potentially accessing confidential data, modifying application logic, or disrupting business processes. Publicly available exploit code has not been identified at time of analysis.