MSRC-CVE-2026-70213 — Microsoft Power Apps Remote Code Execution Vulnerability

Summary

Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, user interaction is required (UI:R) and privileges required is low (PR:L). What does that mean for this vulnerability?
An authorized attacker must send the user a malicious link and convince the user to open it.

Security updates
3.26085.7 — https://play.google.com/store/apps/details?id=com.microsoft.msapps&hl=en_US

Vulnerabilities 1

High 8.0

CVE-2026-70213

Microsoft Power Apps Remote Code Execution Vulnerability

Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.

Microsoft Microsoft Power Apps for Android Android

Oct 13, 2026

Revision history

2026-10-16 #2
Updated an acknowledgement. This is an informational change only.
2026-10-13 #1
Information published.

References

CVE-2026-70213 Microsoft Power Apps Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70213
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss