9.0
Critical
CVE-2026-26149 Improper neutralization of escape, meta, or control sequences in Microsoft Power Apps allows an authorized attacker to…
Description
Improper neutralization of escape, meta, or control sequences in Microsoft Power Apps allows an authorized attacker to perform spoofing over a network.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft Power Apps 3.26032 | earliest → < 3.26032.10.0 | 3.26032.10.0 |
| Microsoft Power Apps Desktop Client 1.0 | 1.0.0 → < 3.26032.10.0 | 3.26032.10.0 |
References
- Microsoft Power Apps Desktop Client Spoofing Vulnerability msrc.microsoft.com
Timeline
- Published
- Last modified
Other CVEs of Microsoft Power Apps
The 8 CVEs of Microsoft Power Apps →
CVE-2026-70213
Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network
8.0
High
CVE-2026-59118
Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network
9.3
Critical
CVE-2026-32172
Uncontrolled search path element in Microsoft Power Apps allows an unauthorized attacker to execute code over a network
8.0
High
CVE-2026-20960
Improper authorization in Microsoft Power Apps allows an authorized attacker to execute code over a network
8.0
High