Read the docs
TI-2026-72282 Aliases CVE-2026-70213GHSA-jxmh-w5xx-jqc7

Origin validation error in Microsoft Power Apps for Android

Priority LOW 37CWE-346Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from Microsoft.

Summary

Microsoft Power Apps for Android from 1.0.0 before 3.26085.7 contains an origin validation error (CWE-346). An authorized attacker with low privileges can execute code over a network, and a user must interact with the attack.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00386 32nd percentileScored 2026-11-07
Fix Fixed Microsoft Power Apps for Android (Microsoft): 3.26085.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft Power Apps for Android1.0.0 to before 3.26085.73.26085.7Patch availableCNA
  • Microsoft Power Apps for Android VendorMicrosoft Affected 1.0.0 to before 3.26085.7 Fixed in 3.26085.7 Patch available CNA

Remediation

Update Microsoft Power Apps for Android to version 3.26085.7, which is released as a Security Update.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

  • Fix · CNA Microsoft Power Apps for Android (Microsoft) Fixed in 3.26085.7

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Remote Code Execution
Exploited
No
Publicly disclosed
No
Exploitability
Exploitation Less Likely
ProductStatusPlan or fix
Microsoft Power Apps for AndroidFixed 3.26085.7 · Security Update

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-70213
  2. 2026-10-13 Alias added: GHSA-jxmh-w5xx-jqc7
  3. 2026-10-13 CISA SSVC decision points changed
  4. 2026-10-14 Priority changed: MEDIUM → LOW
  5. 2026-10-16 Affected versions changed · CNA

References

Patch 1

  • TI-2026-42212 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-37256 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-26194 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-16982 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-36863 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-33671 Microsoft SharePoint Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
See all 18045 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences