What is the CVSS score of CVE-2026-32172?

CVE-2026-32172 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Microsoft Power Apps are affected by CVE-2026-32172?

A remote code execution vulnerability in Microsoft Power Apps (CVE-2026-32172) could allow attackers to compromise business workflows and data through social engineering; however, real-world risk…. A patch is available.

How to fix or mitigate CVE-2026-32172?

Within 24 hours, identify all Power Apps deployments in your organization and notify stakeholders of the available patch for CVE-2026-32172. Within 7 days, test the patch in a non-production Power Apps environment to confirm compatibility with business-critical workflows. Within 30 days, complete patch deployment to all production Power Apps instances; given the low real-world exploitation likelihood (EPSS 0.04%) and high attacker effort required, this can proceed as a standard maintenance cycle rather than emergency patching.

Microsoft Power Apps CVE-2026-32172

EUVD-2026-25308 HIGH

Uncontrolled Search Path Element (CWE-427)

2026-04-23 microsoft

GHSA-6fcx-x4g2-7cfw

Authentication Bypass Microsoft Microsoft Power Apps

8.0

CVSS 3.1 · NVD

Temporal: 7.0

Severity by source

NVD PRIMARY

8.0 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

CIRCL (temporal)

7.0 HIGH

cvss

vuln.today AI

8.0 HIGH

Network-reachable but requires victim interaction (UI:R) and non-trivial search-path conditions (AC:H) with no auth (PR:N); hijacked code loads across a trust boundary (S:C) yielding high C/I but no availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:33 vuln.today

EUVD ID Assigned

Apr 23, 2026 - 22:15 euvd

EUVD-2026-25308

Patch released

Apr 23, 2026 - 22:15 nvd

Patch available

CVE Published

Apr 23, 2026 - 21:37 nvd

HIGH 8.0

DescriptionCVE.org

Uncontrolled search path element in Microsoft Power Apps allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Power Apps arises from an uncontrolled search path element (CWE-427) that lets an unauthorized attacker run arbitrary code over a network when a victim is lured into a triggering action. The flaw carries a CVSS 8.0 rating with a scope-changed impact, but exploitation requires high attacker effort and user interaction, and there is no public exploit identified at time of analysis. EPSS is very low (0.04%, 13th percentile) and CISA SSVC records no known exploitation, indicating limited real-world weaponization so far.

Technical ContextAI

Microsoft Power Apps is Microsoft's low-code application development platform within the Power Platform / Microsoft 365 ecosystem (CPE cpe:2.3:a:microsoft:microsoft_power_apps). The root cause is CWE-427, Uncontrolled Search Path Element, the vulnerability class behind library/DLL/binary hijacking: the software resolves a resource (library, module, or executable) from a search path an attacker can influence, causing it to load attacker-controlled code instead of the intended trusted component. The CVSS scope-changed metric (S:C) indicates the executed code can affect resources beyond the vulnerable component's original security authority, which is consistent with a hijacked-component loading a payload that crosses a trust boundary.

RemediationAI

Apply the vendor fix: Patch available per Microsoft advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32172); consult the MSRC Security Update Guide entry for the exact serviced build, as no explicit fix version string is provided in the available intelligence and version numbers should not be invented. Because Power Apps is a Microsoft-hosted/serviced platform, the fix may be delivered service-side or via updated client components, so verify that any locally installed Power Apps client, connector, or gateway components are updated to the vendor-listed build. As a compensating control for a CWE-427 search-path issue, restrict which directories the affected component loads executable code and libraries from and ensure application binaries and their trusted library locations are not writable by non-privileged users, which reduces the chance of an attacker-controlled element being resolved; note this can break components that legitimately load from user-writable paths. Given UI:R, also reinforce user-awareness controls to reduce the likelihood a victim performs the required triggering action.