CVE-2026-26149: Microsoft Power Apps

Critical severity, CVSS 9.0. EPSS: 0.8% chance of exploitation in the next 30 days.

Improper neutralization of escape, meta, or control sequences in Microsoft Power Apps allows an authorized attacker to perform spoofing over a network.

Affected products

• Microsoft Power Apps: before 3.26032.10.0 (fixed in 3.26032.10.0)

Published 2026-04-14. Last modified 2026-06-17.