The vulnerability identified as CVE-2026-26149 affects Microsoft Power Apps Desktop Client version 1.0.0. It involves improper neutralization of escape, meta, or control sequences (CWE-150), which can be exploited by an authorized attacker to conduct spoofing attacks over a network. The CVSS v3.1 base score is 9.0, reflecting critical severity with network attack vector, low attack complexity, required privileges, user interaction, and scope change. Microsoft has issued a temporary fix for this vulnerability as per their advisory.

Successful exploitation of this vulnerability can lead to spoofing attacks that compromise confidentiality, integrity, and availability of the affected system. The attacker must have some level of authorization and user interaction is required. The scope of impact extends beyond the vulnerable component, affecting other components or systems.

Microsoft has provided a temporary fix for this vulnerability. Users of Microsoft Power Apps Desktop Client version 1.0.0 should apply the temporary fix as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26149. Monitor the vendor advisory for updates regarding a permanent fix.