Microsoft Power Apps Remote Code Execution Vulnerability

CVE-2026-70213 is a remote code execution vulnerability in Microsoft Power Apps (rated Important, CVSS 8.0).

1 version

Microsoft id: CVE-2026-70213
Products: Microsoft Power Apps
Severity: Important
Impact: Remote Code Execution
CVSS: 8.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Exploited: No
Publicly disclosed: No
Exploitability: Exploitation Less Likely
Customer action required: Yes
Release: 2026-Oct
Assigned by: Microsoft
Weakness: CWE-346: Origin Validation Error
MSRC revision: 1.1
Status pages: Power Apps status
First captured by us: 13 Nov 2026, 16:03 UTC (from our first import of this list)
Microsoft last modified: 16 Oct 2026, 14:00 UTC
Source: Security updates · open the original at Microsoft

Microsoft's revision notes

Revision 1.0, 2026-10-13: Information published.
Revision 1.1, 2026-10-16: Updated an acknowledgement. This is an informational change only.

Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.

Security updates, 14:00 UTC, 16 Oct

One version so far. If Microsoft edits it, each change shows here with what was removed and added.

First version we captured · 16:03 UTC, 13 Nov
The text as we first saw it
Seen by us 16:03 UTC, 13 Nov · Microsoft's timestamp 14:00 UTC, 16 Oct · Microsoft's page

Last updated 13 Nov 2026, 16:03 UTC