This vulnerability (CVE-2026-26149) in Microsoft Power Apps Desktop Client arises from improper neutralization of escape, meta, or control sequences (CWE-150). It enables an attacker with authorized access to conduct spoofing attacks over a network, potentially compromising data confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, user interaction, and scope change with critical impact on all security properties. Microsoft has issued a temporary fix to mitigate this issue.

Successful exploitation allows an authorized attacker to spoof network communications, which can lead to full compromise of confidentiality, integrity, and availability of affected systems running Microsoft Power Apps Desktop Client 1.0.0. This can result in unauthorized data disclosure, data manipulation, and service disruption.

Microsoft has provided a temporary fix for this vulnerability. Users should apply the temporary fix as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26149. Since this is not a full official fix, monitoring the vendor advisory for a permanent patch is recommended.