Microsoft Power Apps
Monthly
Remote code execution in Microsoft Power Apps arises from an uncontrolled search path element (CWE-427) that lets an unauthorized attacker run arbitrary code over a network when a victim is lured into a triggering action. The flaw carries a CVSS 8.0 rating with a scope-changed impact, but exploitation requires high attacker effort and user interaction, and there is no public exploit identified at time of analysis. EPSS is very low (0.04%, 13th percentile) and CISA SSVC records no known exploitation, indicating limited real-world weaponization so far.
Escape sequence injection in Microsoft Power Apps versions prior to 3.26032.10.0 allows authenticated attackers with low privileges to bypass security controls and achieve remote code execution with high confidentiality, integrity, and availability impact across security boundaries. The vulnerability requires user interaction and affects Power Apps 1710 (build 9.2.23071.136 and earlier). EPSS score of 0.08% (23rd percentile) suggests low probability of mass exploitation despite critical CVSS 9.0 rating. Vendor patch available via Microsoft Security Response Center advisory.
Remote code execution in Microsoft Power Apps arises from an uncontrolled search path element (CWE-427) that lets an unauthorized attacker run arbitrary code over a network when a victim is lured into a triggering action. The flaw carries a CVSS 8.0 rating with a scope-changed impact, but exploitation requires high attacker effort and user interaction, and there is no public exploit identified at time of analysis. EPSS is very low (0.04%, 13th percentile) and CISA SSVC records no known exploitation, indicating limited real-world weaponization so far.
Escape sequence injection in Microsoft Power Apps versions prior to 3.26032.10.0 allows authenticated attackers with low privileges to bypass security controls and achieve remote code execution with high confidentiality, integrity, and availability impact across security boundaries. The vulnerability requires user interaction and affects Power Apps 1710 (build 9.2.23071.136 and earlier). EPSS score of 0.08% (23rd percentile) suggests low probability of mass exploitation despite critical CVSS 9.0 rating. Vendor patch available via Microsoft Security Response Center advisory.