Cyber Posture

CVE-2026-32172

High

Published: 23 April 2026

Published
23 April 2026
Modified
29 April 2026
KEV Added
Patch
CVSS Score 8.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
EPSS Score 0.0005 14.6th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-32172 is a high-severity Uncontrolled Search Path Element (CWE-427) vulnerability in Microsoft Power Apps. Its CVSS base score is 8.0 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 14.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 CM-10 (Software Usage Restrictions) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly remediates the uncontrolled search path vulnerability in Microsoft Power Apps by applying vendor patches as specified in the MSRC advisory.

prevent

Restricts execution to only authorized software programs, preventing attacker-placed malicious code in search paths from running despite user interaction.

prevent

Enforces baseline configuration settings like safe DLL search order to reduce the risk of loading executables from uncontrolled paths in Power Apps.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1574.002 DLL Side-Loading Stealth
Adversaries may execute their own malicious payloads by side-loading DLLs.
Why these techniques?

CWE-427 uncontrolled search path directly enables DLL side-loading (T1574.002) to achieve arbitrary code execution; the remote client-side RCE nature with user interaction maps to exploitation for client execution (T1203).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Uncontrolled search path element in Microsoft Power Apps allows an unauthorized attacker to execute code over a network.

Deeper analysisAI

CVE-2026-32172 is an uncontrolled search path element vulnerability (CWE-427) affecting Microsoft Power Apps. Published on 2026-04-23, it enables an unauthorized attacker to execute code over a network, earning a CVSS v3.1 base score of 8.0 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N).

An unauthorized attacker with network access can exploit this vulnerability, though it requires high attack complexity and user interaction. Successful exploitation allows scope expansion with high confidentiality and integrity impacts, such as arbitrary code execution on the targeted system.

Microsoft's Security Response Center provides guidance on mitigation and patches in its update advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32172. Security practitioners should consult this resource for deployment instructions and verify affected Power Apps versions.

Details

CWE(s)

Affected Products

microsoft
power apps
all versions

CVEs Like This One

CVE-2026-26149Same product: Microsoft Power Apps
CVE-2026-20960Same product: Microsoft Power Apps
CVE-2025-21206Same vendor: Microsoft
CVE-2025-24039Same vendor: Microsoft
CVE-2025-26631Same vendor: Microsoft
CVE-2025-25003Same vendor: Microsoft
CVE-2025-24998Same vendor: Microsoft
CVE-2025-57836Same vendor: Microsoft
CVE-2024-55540Same vendor: Microsoft
CVE-2024-55543Same vendor: Microsoft

References