← Back

CVE-2026-26149

nvd nist
Published: Apr 14, 2026Modified: Jun 17, 2026

JSON object

Loading...
9.0
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Exploitability: 2.3 / Impact: 6.0
Source: secure@microsoft.com (Secondary)

Description

Improper neutralization of escape, meta, or control sequences in Microsoft Power Apps allows an authorized attacker to perform spoofing over a network.

Affected (1)

Microsoft
1 product
Power Apps
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Power Apps
Before 3.26032.10.0

Related CWEs

CWE-150
Improper Neutralization of Escape, Meta, or Control Sequences
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

References (1)

Source: secure@microsoft.com
Vendor Advisory

Timeline

No history available yet.