This vulnerability (CVE-2026-26149) in Microsoft Power Apps Desktop Client 1.0.0 is classified under CWE-150, which concerns improper neutralization of escape, meta, or control sequences. Such improper neutralization can enable an authorized attacker to conduct spoofing attacks over a network, potentially compromising communication authenticity and data integrity. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, user interaction, and a scope change with high impact on confidentiality, integrity, and availability. Microsoft has issued a temporary fix for this vulnerability, as detailed in their security advisory.

An authorized attacker can exploit this vulnerability to perform spoofing attacks over a network, which may lead to unauthorized data disclosure, data modification, and disruption of service. The vulnerability affects confidentiality, integrity, and availability of the affected system. Given the CVSS score of 9.0, the impact is critical.

Microsoft has provided a temporary fix for this vulnerability. Users should apply the temporary fix as directed in the Microsoft advisory. Monitor the Microsoft Security Response Center for updates regarding an official patch or permanent remediation. Since this is not a cloud service, remediation depends on applying the fix on affected client installations.