How to fix CVE-2026-26149?

Within 24 hours: Identify all Power Apps deployments and document current versions. Within 7 days: Update Microsoft Power Apps to version 3.26032.10.0 or later across all affected instances and verify patch deployment. Within 30 days: Conduct access log audit for any suspicious privilege escalation activity post-patch and review delegated access permissions within Power Apps environments.

Is Microsoft Power Apps affected by CVE-2026-26149?

Microsoft Power Apps versions before 3.26032.10.0 contain a critical authentication bypass vulnerability enabling attackers to escalate privileges across application scopes and compromise confidentiality, integrity, and availability.

CVE-2026-26149

EUVD-2026-22371 CRITICAL

2026-04-14 microsoft

GHSA-grqv-qmhw-8pwc

Authentication Bypass Microsoft Microsoft Power Apps

9.0

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 19:12 vuln.today

DescriptionNVD

Improper neutralization of escape, meta, or control sequences in Microsoft Power Apps allows an authorized attacker to bypass a security feature over a network.

AnalysisAI

Authenticated attackers can bypass security controls in Microsoft Power Apps versions prior to 3.26032.10.0 by injecting escape or control sequences, enabling cross-scope privilege escalation with high impact to confidentiality, integrity, and availability. The CVSS 9.0 (Critical) score reflects network-based attack vector with low complexity requiring user interaction. …

RemediationAI

Within 24 hours: Identify all Power Apps deployments and document current versions. Within 7 days: Update Microsoft Power Apps to version 3.26032.10.0 or later across all affected instances and verify patch deployment. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-26149 vulnerability details – vuln.today

Back

CVE-2026-26149

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Full analysis requires sign-in

Share

External POC / Exploit Code