This vulnerability arises from an uncontrolled search path element that Microsoft Power Apps does not validate. It permits an unauthorized attacker who can reach the application over a network to execute arbitrary code on the host system. The weakness is classified as CWE‑427, indicating a failure to control the execution path. Exploitation would compromise the integrity and availability of the affected environment and could lead to full system compromise.

Microsoft Power Apps. No specific version information is provided, so all current releases are potentially vulnerable until a patch is applied.

The CVSS base score of 8 signals high severity. The EPSS score of less than 1% indicates a low current exploitation likelihood, and the vulnerability is not listed in the CISA KEV catalog. The description suggests the likely attack vector is a network‑remote connection, requiring the attacker to connect to the Power Apps instance. No privileged escalation is stated, so an unauthenticated or low‑privilege attacker could potentially exploit the flaw if network access is granted.