CVE-2026-70213: Microsoft Power Apps RCE Vulnerability

CVE-2026-70213 Overview

CVE-2026-70213 is an origin validation error [CWE-346] in Microsoft Power Apps. The flaw allows an authenticated attacker to execute code over a network against a vulnerable Power Apps deployment. Exploitation requires low privileges and user interaction, but successful attacks compromise confidentiality, integrity, and availability of the affected system.

Microsoft published advisory information for this vulnerability through the Microsoft Security Response Center (MSRC). The weakness stems from the application accepting requests or data from an untrusted origin without properly validating the source.

Critical Impact

An authorized attacker can execute arbitrary code over the network through improper origin validation, leading to full compromise of the targeted Power Apps instance.

Affected Products

• Microsoft Power Apps (see the Microsoft Vulnerability Advisory CVE-2026-70213 for version details)

Discovery Timeline

• 2026-10-13 - CVE CVE-2026-70213 published to NVD
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-70213

Vulnerability Analysis

The vulnerability is classified under [CWE-346] Origin Validation Error. Microsoft Power Apps fails to correctly verify that a request, message, or data originates from a trusted source. An authenticated attacker can craft requests that the application incorrectly accepts as legitimate, enabling code execution within the application context.

The attack is network-reachable and requires the attacker to hold low-level privileges on the target environment. User interaction is also required for successful exploitation, which typically means a victim must click a link or load attacker-controlled content. Successful exploitation impacts confidentiality, integrity, and availability of the affected Power Apps instance.

Root Cause

Origin validation errors occur when an application trusts input or messages based on an attacker-controllable source identifier. In Power Apps, the component responsible for checking the origin of cross-context messages, requests, or API calls does not enforce a strict allowlist. Attackers can impersonate a trusted origin and inject commands that the application processes with elevated trust.

Attack Vector

An authenticated attacker with low privileges initiates a network request or hosts content that interacts with a Power Apps session. The victim user interacts with the attacker-controlled content, such as visiting a crafted URL or opening a malicious page. The Power Apps component accepts the crafted origin as trusted and executes attacker-supplied code within the victim's session context.

No verified proof-of-concept code is publicly available for CVE-2026-70213 at this time. See the Microsoft Vulnerability Advisory CVE-2026-70213 for authoritative technical details.

Detection Methods for CVE-2026-70213

Indicators of Compromise

• Unexpected cross-origin requests to Power Apps endpoints from domains not on an organizational allowlist.
• Power Apps session activity originating from referrers or Origin headers inconsistent with normal user workflows.
• Anomalous code or script execution within Power Apps canvas or model-driven app sessions tied to low-privilege user accounts.

Detection Strategies

• Review Microsoft 365 and Power Platform audit logs for abnormal API calls, embed activity, or iframe-hosted sessions.
• Correlate authentication events with subsequent Power Apps actions to identify sessions driven by external, attacker-controlled pages.
• Hunt for unusual outbound connections from Power Apps automation flows that follow a user interaction event.

Monitoring Recommendations

• Enable detailed Power Platform activity logging and forward events to a centralized SIEM for retention and analysis.
• Monitor browser-based telemetry for Power Apps embedding in untrusted parent frames or domains.
• Alert on first-time external origins interacting with Power Apps endpoints across the tenant.

How to Mitigate CVE-2026-70213

Immediate Actions Required

• Apply the Microsoft update referenced in the MSRC advisory for CVE-2026-70213 as soon as it is available in your tenant.
• Audit Power Apps users with low-privilege roles and remove unnecessary access to limit the attacker population.
• Educate users on avoiding untrusted links that embed or interact with Power Apps sessions.

Patch Information

Microsoft addresses CVE-2026-70213 through platform-level updates to the Power Apps service. Because Power Apps is a cloud-hosted service, Microsoft deploys the fix centrally. Verify tenant service health notifications and the MSRC advisory for confirmation that remediation is active in your region.

Workarounds

• Restrict Power Apps embedding to a strict allowlist of trusted internal domains using tenant isolation and Content Security Policy controls where supported.
• Enforce conditional access policies that require compliant devices and trusted networks for Power Platform access.
• Disable or restrict external sharing of Power Apps until the vendor patch is confirmed deployed in your environment.

# Example: enforce conditional access scoping for Power Platform via Microsoft Graph PowerShell
# Review and adapt to your tenant policy framework before deployment
Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess"
Get-MgIdentityConditionalAccessPolicy | Where-Object { $_.Conditions.Applications.IncludeApplications -contains "Power Apps" }