Microsoft EUVD-2026-22371

Apply vendor-released patch by upgrading Microsoft Power Apps to version 3.26032.10.0 or later as detailed in Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26149. Organizations should prioritize Power Apps instances handling sensitive data or exposed to broader user populations. For environments where immediate patching is not feasible, implement compensating controls including restricting Power Apps access to trusted user populations only, implementing enhanced monitoring for anomalous authentication patterns or unexpected data access following user interactions, enforcing least-privilege principles for Power Apps user roles to limit PR:L access grants, and conducting user awareness training about social engineering attacks that could provide the required user interaction component. Note that access restrictions may limit business functionality and monitoring overhead requires security operations capacity. Review and sanitize existing Power Apps that accept user input to identify potential injection points. Validate that authentication mechanisms prevent unauthorized access as the vulnerability requires authenticated (PR:L) access as a prerequisite.