CVE-2026-26149

CVE-2026-26149 is an improper neutralization vulnerability affecting Microsoft Power Apps that allows authorized attackers to conduct spoofing attacks over a network. The flaw stems from inadequate handling of escape, meta, and control sequences within the application. The vulnerability carries a CVSS score of 9.0 (Critical), with a network-based attack vector requiring low complexity and user interaction. An authenticated attacker can exploit this to compromise confidentiality, integrity, and availability across system boundaries, representing significant risk to affected organizations. There is currently no evidence of active exploitation in the wild, as the vulnerability does not appear on the Known Exploited Vulnerabilities catalog and is classified as inactive on threat tracking lists. The EPSS score of 0.0006 indicates minimal exploitation probability compared to other CVEs, though organizations should prioritize patching given the critical severity rating and the moderate FAUCET risk score of 42.0.