CVE-2026-70213: Microsoft Power Apps Remote Code Execution Vulnerability
Published Oct 13, 2026
·Updated
Microsoft Power Apps Remote Code Execution Vulnerability
Other sources
Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.
— Microsoft
Affected Software
2 affected componentsFixes available
Microsoft Power Apps for Android<3.26085.7
3.26085.7
Microsoft Power Apps<2608.5
2608.5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.26085.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2608.5
Event History
Oct 13, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
DescriptionSeverity
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker must be authorized and have low-level privileges. Exploitation is performed over a network and also requires user interaction.
2
What security impact could successful exploitation have?
Successful exploitation could allow remote code execution with high impact to confidentiality, integrity, and availability.
3
What is the underlying flaw?
The issue is an origin validation error in Microsoft Power Apps.