Microsoft Power Apps vulnerabilities

7 CVEs affecting Microsoft Power Apps, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-59118, published 2026-08-07.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-47733, published 2025-05-08. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. Server-Side Request Forgery (SSRF) in Microsoft Power Apps allows an unauthorized attacker to disclose information over a network
• CVE-2023-32024, published 2023-06-14. Low severity, CVSS 3.0. EPSS: 1.5% chance of exploitation in the next 30 days. Microsoft Power Apps Spoofing Vulnerability
• CVE-2026-26149, published 2026-04-14. Critical severity, CVSS 9.0. EPSS: 0.8% chance of exploitation in the next 30 days. Improper neutralization of escape, meta, or control sequences in Microsoft Power Apps allows an authorized attacker to perform spoofing over a network.
• CVE-2026-59118, published 2026-08-07. Critical severity, CVSS 9.3. EPSS: 0.7% chance of exploitation in the next 30 days. Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-32172, published 2026-04-23. High severity, CVSS 8.0. EPSS: 0.6% chance of exploitation in the next 30 days. Uncontrolled search path element in Microsoft Power Apps allows an unauthorized attacker to execute code over a network.
• CVE-2023-32052, published 2023-07-11. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. Microsoft Power Apps (online) Spoofing Vulnerability
• CVE-2026-20960, published 2026-01-16. High severity, CVSS 8.0. EPSS: 0.5% chance of exploitation in the next 30 days. Improper authorization in Microsoft Power Apps allows an authorized attacker to execute code over a network.