CVE-2026-26149: Microsoft Power Apps Desktop Client Spoofing Vulnerability
CVE-2026-26149 is a spoofing vulnerability in Microsoft Power Apps Desktop Client, rated Important by Microsoft, with a CVSS 3.1 base score of 9 (Critical). An attacker can exploit it remotely over the network, with low privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.56% probability of exploitation activity in the next 30 days, higher than 47% of all scored vulnerabilities. Microsoft released the fix on 14 April 2026 in the April 2026 Patch Tuesday. It affects 1 product in 1 product family (Azure).
Key facts
- CVE ID
- CVE-2026-26149
- Severity
- Critical CVSS 9
- Microsoft severity
- Important
- Impact
- Spoofing
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- Weakness
- CWE-150
- EPSS
- 0.56% (percentile 47%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- April 2026 Patch Tuesday
- Product families
- Azure
From the April 2026 Patch Tuesday briefing
Microsoft Power Apps Desktop Client Spoofing Vulnerability
This Critical 9.0 spoofing issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) maps to CWE-150 (Improper Neutralization of Escape, Meta, or Control Sequences) and is best understood as a trust-manipulation primitive rather than a pure memory corruption bug. The vector indicates an attacker needs some authenticated foothold (PR:L) and user interaction (UI:R), for example, a low-privileged user session where the victim is induced to open or interact with crafted content inside the Power Apps Desktop client. The Scope: Changed (S:C) component is the red flag: successful spoofing can cross a trust boundary, enabling actions or data access that the user did not intend.
From the briefing, written by an AI model from PatchaPalooza's data.
CVSS score and vector
Microsoft scores CVE-2026-26149 at 9 (temporal 7.9) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:T/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | Required |
| Scope | Changed |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | High |
| Exploit code maturity | Unproven |
| Remediation level | Temporary fix |
| Report confidence | Confirmed |
Description
Improper neutralization of escape, meta, or control sequences in Microsoft Power Apps allows an authorized attacker to perform spoofing over a network.
Frequently asked questions (Microsoft)
According to the CVSS metric, user interaction is required (UI:R) and privileges required are Low (PR:L). What does that mean for this vulnerability?
A user must interact with a malicious Power Apps canvas app, such as by opening or using it.
Additionally, an attacker only needs basic capabilities to create or share a Power App; they do not need administrative access.
According to the CVSS metric, successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?
This vulnerability could lead to the attacker gaining the ability to interact with other tenant’s applications and content.
How could an attacker exploit this vulnerability?
An attacker could create a malicious Power Apps canvas app that includes an external protocol link disguised with leading whitespace. When a user opens the app, the resulting warning dialog may appear incomplete or misleading. If the user proceeds, the app could trigger an external protocol call that performs unintended actions on the user’s device.
Affected products (1)
Azure
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Microsoft Power Apps Desktop Client | Release Notes | Security Update | 3.26032.10.0 | Maybe |
NIST NVD data
- NVD status
- Analyzed
- NVD CVSS
- 9 (CRITICAL)
- NVD weakness
- CWE-150
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| power apps | before 3.26032.10.0 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26149 (Vendor Advisory)
Acknowledgments
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. | |
| 1.1 | The security impact for this vulnerability has been revised. This change does not affect the available security updates. Customers should continue to install the recommended updates to remain protected from this vulnerability. | |
| 1.2 | Change the name of the affected software from Microsoft Power Apps to Microsoft Power Apps Desktop Client. This is an informational change only. |