Skip to content

CVE-2026-23652 — Microsoft Power Pages

Key facts

CVE-2026-23652 (Microsoft) is a Critical (10.0) vulnerability: Microsoft Power Pages. This entry ships ready-to-deploy detection and prevention rules (Snort) plus a detection-only PoC and a Docker test lab.
CVE CVE-2026-23652
Severity Critical (10.0)
Vendor Microsoft
Product Microsoft Power Pages
Detection / prevention Snort
PoC poc.py
Source 2026/CVE-2026-23652/

Details

CVE-2026-23652 (Microsoft) is a Critical (10.0) vulnerability: Microsoft Power Pages. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort) — see Detection and prevention below. Source: NVD record.

Overview

Field Value
CVE CVE-2026-23652
CVSS 10.0 (Critical)
Vendor Microsoft
Product Microsoft Power Pages
Affected Microsoft Power Pages sites (all tenants prior to patch)
Fixed Apply Microsoft security update; no manual upgrade required for cloud tenants

Root Cause

Microsoft Power Pages improperly neutralizes special elements (shell metacharacters, command separators, and argument injection characters) when incorporating user-supplied input into server-side command execution contexts. The platform's low-code/no-code portal engine constructs system-level commands or invokes external processes using unsanitized values from HTTP request parameters or form fields, violating CWE-77 (Improper Neutralization of Special Elements used in a Command). The vulnerability is reachable without authentication on publicly exposed Power Pages sites.

Problem

An unauthenticated remote attacker can inject arbitrary operating system commands by supplying crafted input to vulnerable Power Pages endpoints:

  • Unauthenticated RCE: Execute arbitrary commands on the underlying server infrastructure with the privileges of the Power Pages service account.
  • Data exfiltration: Read sensitive configuration files, environment variables, and database connection strings from the server.
  • Lateral movement: Use the compromised server as a pivot point to attack internal Microsoft datacenters or customer-connected resources.
  • Tenant data compromise: Access or modify data across Power Pages sites hosted in the same environment.
  • Backdoor installation: Deploy persistent access mechanisms or malware on the hosting infrastructure.

Because Power Pages sites are frequently exposed to the public internet, the attack surface is broad.

Detection

Run the proof-of-concept against your Power Pages site:

python poc.py --target https://<your-site>.powerappsportals.com --test-cmd "id"

The PoC injects a time-based or out-of-band command execution payload into known vulnerable parameters. Confirm vulnerability by observing: - A measurable response delay (time-based blind injection) - DNS/HTTP callback to an attacker-controlled listener (out-of-band) - Direct command output in the response body (if verbose errors are enabled)

WAF detection signatures to enable: - Semicolon/pipe/backtick sequences in POST bodies - $(...) and `...` shell substitution patterns - Common shell commands (id, whoami, curl, wget) in form fields

Remediation

  1. Apply Microsoft security update: Microsoft automatically patches cloud-hosted Power Pages. Verify your site's version in the Power Platform admin center under Environment details.
  2. Enforce WAF rules: Deploy Azure Front Door or Azure Application Gateway with OWASP CRS 3.3+ ruleset, enabling command injection rules (942xxx group).
  3. Restrict public access: If the Power Pages site does not need to be publicly accessible, enable IP allowlisting in the Power Platform admin center.
  4. Audit site configuration: Review all custom code (Liquid templates, JavaScript, Power Automate flows) for patterns that pass user input to server-side commands.
  5. Enable Microsoft Defender for Cloud: Turn on runtime threat detection for Power Platform to alert on anomalous command execution patterns.
  6. Review access logs: Inspect Power Pages telemetry and Azure Monitor logs for anomalous POST requests to form endpoints prior to patch application.

References

  • NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-23652
  • Microsoft Security Response Center: https://msrc.microsoft.com
  • Power Platform Security Documentation: https://learn.microsoft.com/en-us/power-platform/admin/security

Detection and prevention

Ready-to-deploy defensive rules for CVE-2026-23652, for authorized testing and blue-team detection engineering:

References: NVD — CVE-2026-23652 · full write-up on the searchable site

Detection & prevention rules

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"CVE-2026-23652 Power Pages OS command injection shell metacharacters"; flow:to_server,established; content:".powerapps.com"; http_header; pcre:"/[;&|`$\(\)\\\\]\s*(?:cat|wget|curl|bash|sh|cmd|powershell|nc|python|perl)/i"; classtype:web-application-attack; sid:9002700; rev:1;)
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"CVE-2026-23652 Power Pages command injection encoded shell chars in POST"; flow:to_server,established; content:"POST"; http_method; content:".powerapps.com"; http_header; pcre:"/(?:%3b|%7c|%60|%26%26|%7c%7c)\s*(?:id|whoami|uname|cat|ls|dir)/i"; http_client_body; classtype:web-application-attack; sid:9002701; rev:1;)
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"CVE-2026-23652 Power Pages command injection double-pipe or ampersand chaining"; flow:to_server,established; content:".powerapps.com"; http_header; pcre:"/(?:\|\||&&|;\s*\w+\s*[=;|&])/"; classtype:web-application-attack; sid:9002702; rev:1;)

:material-file-download: prevention/snort.rules

Frequently asked questions

What is CVE-2026-23652?

CVE-2026-23652 (Microsoft) is a Critical (10.0) vulnerability: Microsoft Power Pages. This entry ships ready-to-deploy detection and prevention rules (Snort) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-23652?

Deploy the Snort detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-23652?

Upgrade to a fixed version per the vendor advisory; the NVD record lists the affected versions. Use the included PoC to verify your remediation.

Other entries for the same vendor or product:

For authorized security testing and research only. See the full source and NVD record.