Microsoft Power Apps
Monthly
Remote code execution in Microsoft Power Apps arises from an uncontrolled search path element (CWE-427) that lets an unauthorized attacker run arbitrary code over a network when a victim is lured into a triggering action. The flaw carries a CVSS 8.0 rating with a scope-changed impact, but exploitation requires high attacker effort and user interaction, and there is no public exploit identified at time of analysis. EPSS is very low (0.04%, 13th percentile) and CISA SSVC records no known exploitation, indicating limited real-world weaponization so far.
Remote code execution in Microsoft Power Apps arises from an uncontrolled search path element (CWE-427) that lets an unauthorized attacker run arbitrary code over a network when a victim is lured into a triggering action. The flaw carries a CVSS 8.0 rating with a scope-changed impact, but exploitation requires high attacker effort and user interaction, and there is no public exploit identified at time of analysis. EPSS is very low (0.04%, 13th percentile) and CISA SSVC records no known exploitation, indicating limited real-world weaponization so far.