Microsoft Power Apps Vulnerability Allows Remote Code Execution

The National Vulnerability Database has disclosed CVE-2026-32172, a high-severity vulnerability in Microsoft Power Apps. This uncontrolled search path element flaw carries a CVSS v3.1 score of 8.0, indicating a significant risk. An unauthorized attacker could exploit this over a network to achieve code execution.

This isn’t a theoretical issue; it’s a critical design flaw (CWE-427) that allows an attacker to dictate where the application looks for executable components. While Microsoft Power Apps is designed to simplify application development, this vulnerability exposes organizations to a fundamental compromise of system integrity. The vector is AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N, meaning it’s network-exploitable, but requires user interaction and high attack complexity. However, the impact on confidentiality and integrity is high.

For defenders, the implication is clear: if an attacker can manipulate the search path, they can trick the application into executing malicious code instead of legitimate binaries. This is a classic method for privilege escalation and persistence. While specific affected products aren’t detailed by the National Vulnerability Database, any organization leveraging Microsoft Power Apps should assume exposure until Microsoft provides specific guidance and patches.