The vulnerability is a command injection flaw (CWE‑77) caused by improper neutralization of special elements used in a system command. An attacker who can send network traffic to a vulnerable Microsoft Power Pages instance can cause arbitrary commands to run, resulting in full remote code execution and compromising confidentiality, integrity and availability of the affected system.

Microsoft Power Pages deployments are affected. The advisory does not specify particular versions; the vulnerability may apply to any current installation of the product. Administrators should verify whether their environment is using a version that is patched by the latest security update.

The CVSS score of 10 indicates critical severity. The EPSS score is unavailable, so the frequency of exploitation in the wild is unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw remotely over the network, indicating that a publicly accessible instance presents a high potential for exploitation if unpatched.