VDB
CVE-2026-26149
CVE-2026-26149
PUBLISHED
CVSS 9 CRITICAL
Improper neutralization of escape, meta, or control sequences in Microsoft Power Apps allows an authorized attacker to bypass a security feature over a network.
EPSS 0.07% · 21.9th percentile
Risk Scores
CVSS 3.1
9
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:T/RC:C
EPSS Score
0.07%
21.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| microsoft | power-apps | 1710 (9.2.23071.136) |
| Microsoft | Microsoft Power Apps | 1710 (9.2.23071.136) |
Exploit Intelligence
Timeline
- Apr 14, 2026 CVE Published
- Apr 14, 2026 PoC Published
- Apr 15, 2026 Security Advisory
- Apr 15, 2026 Security Advisory
- Apr 16, 2026 Security Advisory
- Apr 16, 2026 Security Advisory
- Apr 16, 2026 Security Advisory
- Apr 16, 2026 Security Advisory
- Apr 16, 2026 Security Advisory
- Apr 16, 2026 Security Advisory
- Apr 16, 2026 Security Advisory
- Apr 16, 2026 Security Advisory
References
- Microsoft Power Apps Security Feature Bypass vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-26149 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35611 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26143 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34757 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33103 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32178 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32176 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32167 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32631 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32203 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32184 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32201 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20945 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21637 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23653 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33810 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40385 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40386 advisory
…and 1 more