Microsoft Power Apps EUVD-2026-99610

Exploitation requires a valid authenticated/authorized identity in the Power Apps environment (PR:L) AND active victim interaction (UI:R) - a legitimate user must interact with attacker-supplied content or a malicious origin for the improper origin validation (CWE-346) to be triggered. Affected deployments are limited to Microsoft Power Apps for Android before 3.26085.7 and Power Apps 1710 (9.2.23071.136) before 2608.5; patched versions are not vulnerable. The authentication prerequisite and the dependency on user interaction are the key limiting factors that reduce realistic risk below what the 8.0 base score alone suggests, and CISA SSVC confirms the attack is not automatable.

This is a genuine elevated-priority issue but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 8.0) describes a network-reachable flaw with low attack complexity that nonetheless requires an authenticated/authorized attacker (PR:L) and victim user interaction (UI:R), with total impact to confidentiality, integrity, and availability. These two requirements are corroborated by CISA's SSVC decision, which records Exploitation=none, Automatable=no, and Technical Impact=total - meaning high damage potential but no evidence of active exploitation and no reliable mass-automation path (consistent with the UI:R requirement). No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis. The signals are internally consistent rather than conflicting: high technical impact paired with real exploitation friction (authentication + user interaction + non-automatable). One metadata inconsistency to verify: the input Tag 'Information Disclosure' conflicts with the description and CVSS, which describe code execution with full C/I/A impact (CWE-346 origin validation error), so the tag appears mislabeled and should not drive prioritization. A patch is confirmed available from the vendor, so the practical priority is to deploy the fixed versions promptly rather than to treat this as an actively-exploited zero-day.

An authenticated attacker within a Power Apps tenant crafts content or a malicious origin that abuses the app's improper origin validation, then lures a legitimate user into interacting with it (UI:R). When the victim interacts, the flawed origin check is bypassed and attacker-controlled code executes over the network in the victim's context, yielding high confidentiality, integrity, and availability impact. No public exploit code was identified at time of analysis, and CISA SSVC rates this as not automatable.