Microsoft Power Apps EUVD-2026-25308

Exploitation requires victim user interaction (UI:R) - the attacker cannot trigger the flaw autonomously and must get a user to open, load, or run the affected Power Apps component or content that causes the vulnerable search-path resolution. It also requires satisfying high-attack-complexity conditions (AC:H): the attacker must be able to influence the search path so that an attacker-controlled library/executable is resolved instead of the legitimate one, which typically depends on winning path-precedence or placing a malicious element in a resolvable location. No privileges are required (PR:N), so the actor need not be authenticated to Power Apps, but the combination of required user action and the non-trivial search-path preconditions substantially limits realistic, at-scale exploitation. This is consistent with CISA SSVC (Exploitation: none, Automatable: no).

Signals conflict in a way defenders should weigh carefully. The CVSS base score of 8.0 is driven by network vector (AV:N), scope change (S:C), and high confidentiality/integrity impact (C:H/I:H), but the vector also encodes two significant brakes: high attack complexity (AC:H) and required user interaction (UI:R). Against that, EPSS is only 0.04% (13th percentile) and CISA's SSVC framework records Exploitation: none and Automatable: no, though Technical Impact: total. The picture is a high-severity-but-currently-low-real-risk issue: serious consequences if exploited, yet no observed exploitation, no public PoC, and meaningful preconditions (attacker effort plus victim action) that make opportunistic mass exploitation unlikely. One tension worth flagging: the intelligence Tags label this 'Authentication Bypass', yet the CWE is Uncontrolled Search Path Element and PR:N already assumes no privileges - verify the precise mechanism with Microsoft's advisory before treating it as an auth-bypass. Priority is moderate: patch on a normal cadence rather than emergency footing unless environmental exposure is high.

An attacker crafts a malicious library or executable and positions it where the Power Apps component's uncontrolled search path will resolve it, then induces a victim (via a crafted link, file, or app package) to perform the action that loads the component. Because attack complexity is high, the attacker must satisfy specific conditions and win the search-path resolution, after which their code runs with a scope-crossing impact. No public exploit code has been identified at time of analysis.