Introduction
An uncontrolled search path vulnerability in Microsoft Power Apps scored a CVSS 8.0 and could have allowed unauthenticated remote code execution with a scope change, which means exploitation could have reached beyond the Power Apps component itself. Microsoft remediated it entirely on the server side before public disclosure, and no customer action is required.
There is no active threat to worry about here. The CVE is still worth understanding for what it shows about cloud service vulnerability management and about how CWE-427 applies in a hosted environment.
Technical Information
Root Cause: CWE-427 Uncontrolled Search Path Element
CVE-2026-32172 is rooted in CWE-427, Uncontrolled Search Path Element. This class of vulnerability occurs when an application resolves a resource (such as a library, executable, or configuration file) through a search path that an attacker can influence. In a typical on-premises scenario, this might involve DLL hijacking or PATH manipulation. In a cloud-hosted service like Power Apps, the mechanics are the same. The service resolved a resource through a path that an external party could manipulate, which opened a vector for code execution.
Microsoft has not published specific technical exploit chains or affected version numbers. That is consistent with how it handles cloud service CVEs, where the infrastructure is entirely vendor managed.
CVSS Vector Breakdown
The full CVSS 3.1 vector gives useful context on the nature of this flaw:
| Metric | Value | Interpretation |
|---|---|---|
| Attack Vector | Network (AV:N) | Exploitable remotely over a network |
| Attack Complexity | High (AC:H) | Requires specific conditions or significant attacker effort |
| Privileges Required | None (PR:N) | No prior authentication needed |
| User Interaction | Required (UI:R) | A user must interact with a malicious element |
| Scope | Changed (S:C) | Impact extends beyond the vulnerable component |
| Confidentiality | High (C:H) | Total loss of confidentiality for affected data |
| Integrity | High (I:H) | Total loss of integrity for affected data |
| Availability | None (A:N) | No impact on service availability |
No required privileges plus a scope change is what drives the score to 8.0, despite the high attack complexity and the user interaction requirement. The scope change (S:C) is especially important. It means a successful exploit against the Power Apps component could compromise resources under a different security authority, such as data or services outside the immediate Power Apps boundary.
With no availability impact (A:N) and high confidentiality and integrity impact, this looks like a vector for data exfiltration and manipulation rather than a denial of service path.
Attack Flow
Going by the CVSS metrics and the CWE classification, the general attack flow would have looked like this:
- An unauthorized attacker with no prior authentication (PR:N) crafts a malicious payload that exploits the uncontrolled search path in the Power Apps service.
- The attacker delivers the attack over the network (AV:N), but it succeeds only under specific conditions (AC:H).
- A user must interact with a malicious element to trigger the exploit (UI:R), which suggests the attack involved social engineering or a crafted Power Apps artifact.
- If exploitation succeeds, the attacker gets code execution that crosses a security boundary (S:C) and compromises both the confidentiality and the integrity of data.
Microsoft fixed the flaw by correcting how the Power Apps service resolves resource paths on the server side. That removed the manipulable search path the attack depended on.
April 2026 Power Apps Context
This was not the only high-severity Power Apps vulnerability Microsoft addressed in April 2026. It also patched CVE-2026-26149, a CVSS 9.0 flaw involving Improper Neutralization of Escape, Meta, or Control Sequences. Multiple critical findings for Power Apps in the same release cycle suggest the platform went through a significant security review during this period. Organizations that rely heavily on Power Apps should review their data sharing and tenant boundary policies, especially given the scope change metrics on these flaws.
Patch Information
CVE-2026-32172 affects Microsoft Power Apps, a cloud-hosted service, and Microsoft applied the fix entirely on its side. There is no downloadable patch, KB article, or build number for end users to install.
The MSRC advisory, published on April 23, 2026, says the vulnerability "has already been fully mitigated by Microsoft" and states explicitly that "there is no action for users of this service to take."
The Security Updates table on the MSRC page confirms this. It lists no associated article, download link, or build number, and all fields are marked as empty. The Customer Action Required field is set to Not Required.
By fixing how the Power Apps service resolves resource paths on the server side, Microsoft removed the vector that would have let an unauthorized attacker achieve remote code execution over a network. The Remediation Level in the CVSS temporal metrics is set to Official Fix, which confirms the patch is complete and final. The CVE.org record also tags the MSRC advisory reference as both vendor-advisory and patch, more evidence that the fix is in place.
Microsoft published this CVE under its "Toward greater transparency: Unveiling Cloud Service CVEs" initiative (referenced at https://aka.ms/MSRC-Cloud-CVEs). Under that practice, Microsoft discloses vulnerabilities in cloud services even when customers do not need to take action.
No manual patching steps are required. Microsoft applied the fix server side to the Power Apps cloud platform before public disclosure.
Affected Systems and Versions
The affected product is Microsoft Power Apps. Because Power Apps is an exclusively hosted cloud service, Microsoft has not provided a list of affected product versions, specific build numbers, or vulnerable configurations. The vulnerability existed in Microsoft's cloud infrastructure, and Microsoft remediated it server side before public disclosure. All Power Apps customers are already protected.
Vendor Security History
In the April 2026 update cycle alone, Microsoft released security updates for 165 different CVEs across its products. In Power Apps, it addressed at least two high-severity vulnerabilities:
| CVE Identifier | CVSS Score | Vulnerability Type | Exploitability Status |
|---|---|---|---|
| CVE-2026-26149 | 9.0 | Improper Neutralization of Escape, Meta, or Control Sequences | Exploitation Less Likely |
| CVE-2026-32172 | 8.0 | Uncontrolled Search Path Element | Unproven Exploit Maturity |
Several high-severity Power Apps findings in a single release cycle indicate that the platform was getting focused security research and review. Microsoft published these CVEs under its cloud transparency initiative even though no customer action is needed, which reflects a change in how it approaches cloud service vulnerability disclosure.
Hritik Sateesh, an Application Security Researcher with Stantec, discovered and reported the vulnerability.
