CVE-2026-32172
Published: 23 April 2026
Summary
CVE-2026-32172 is a high-severity Uncontrolled Search Path Element (CWE-427) vulnerability in Microsoft Power Apps. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 25.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-10 (Software Usage Restrictions) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-32172 is an uncontrolled search path element vulnerability (CWE-427) affecting Microsoft Power Apps. Published on 2026-04-23, it enables an unauthorized attacker to execute code over a network, earning a CVSS v3.1 base score of 8.0 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N).
An unauthorized attacker with network access can exploit this vulnerability, though it requires high attack complexity and user interaction. Successful exploitation allows scope expansion with high confidentiality and integrity impacts, such as arbitrary code execution on the targeted system.
Microsoft's Security Response Center provides guidance on mitigation and patches in its update advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32172. Security practitioners should consult this resource for deployment instructions and verify affected Power Apps versions.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25308
Vulnerability details
Uncontrolled search path element in Microsoft Power Apps allows an unauthorized attacker to execute code over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CWE-427 uncontrolled search path directly enables DLL side-loading (T1574.002) to achieve arbitrary code execution; the remote client-side RCE nature with user interaction maps to exploitation for client execution (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the uncontrolled search path vulnerability in Microsoft Power Apps by applying vendor patches as specified in the MSRC advisory.
Restricts execution to only authorized software programs, preventing attacker-placed malicious code in search paths from running despite user interaction.
Enforces baseline configuration settings like safe DLL search order to reduce the risk of loading executables from uncontrolled paths in Power Apps.