This vulnerability in Microsoft Power Apps arises from an uncontrolled search path element (CWE-427), which can be exploited by an unauthorized attacker to execute arbitrary code remotely. The CVSS 3.1 base score is 8.0, indicating high severity, with network attack vector, high attack complexity, no privileges required, and user interaction required. The impact includes complete confidentiality and integrity compromise but no availability impact. Microsoft has issued an official fix to address this vulnerability.

Successful exploitation allows remote code execution by an unauthorized attacker, potentially leading to full compromise of confidentiality and integrity of affected systems running Microsoft Power Apps. There is no reported impact on availability. No known exploits are currently active in the wild.

An official fix is available from Microsoft. Users and administrators should apply the patch provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32172 promptly to remediate this vulnerability.