Microsoft Power Apps
Monthly
Authenticated attackers can bypass security controls in Microsoft Power Apps versions prior to 3.26032.10.0 by injecting escape or control sequences, enabling cross-scope privilege escalation with high impact to confidentiality, integrity, and availability. The CVSS 9.0 (Critical) score reflects network-based attack vector with low complexity requiring user interaction. Vendor patch released (version 3.26032.10.0). No public exploit identified at time of analysis, with EPSS data not provided.
Authenticated attackers can bypass security controls in Microsoft Power Apps versions prior to 3.26032.10.0 by injecting escape or control sequences, enabling cross-scope privilege escalation with high impact to confidentiality, integrity, and availability. The CVSS 9.0 (Critical) score reflects network-based attack vector with low complexity requiring user interaction. Vendor patch released (version 3.26032.10.0). No public exploit identified at time of analysis, with EPSS data not provided.