The issue involves an origin validation error that allows an authorized attacker to execute code over a network. Exploitation requires the attacker to send a user a malicious link and persuade them to open it—an important distinction from an attack that succeeds without user involvement.
What Microsoft’s advisory establishes
The Microsoft Security Response Center identifies the weakness as CWE-346, an origin validation error. Its assessment includes the following details:
| Field | Microsoft advisory value |
|---|---|
| CVE | CVE-2026-70213 |
| Exact title | Microsoft Power Apps Remote Code Execution Vulnerability |
| Severity | Important |
| CVSS base score | 8.0 |
| CVSS temporal score | 7.0 |
| CWE | CWE-346 |
| Affected product | Microsoft Power Apps for Android |
| Vendor fixed build | 3.26085.7 |
| Exploitation assessment | Exploitation Less Likely |
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Microsoft’s reported statuses are:
- Publicly disclosed: No
- Exploited: No
- Customer action required: Yes
Those statuses describe the advisory’s assessment; they should not be read as a reason to defer the prescribed update.
Why the malicious-link requirement matters
Microsoft explains that UI:R means user interaction is required, while PR:L indicates that the attacker needs low privileges. Specifically, an authorized attacker must send the user a malicious link and convince the user to open it.
That gives administrators two distinct considerations. First, this is not described as an unauthenticated, interaction-free attack. Second, the required interaction is opening a link, making user vigilance relevant alongside patch deployment.
The vector also assigns high potential impact to confidentiality, integrity, and availability, with unchanged scope. These are severity characteristics, not evidence that an incident has occurred. Likewise, Microsoft’s Exploitation Less Likely assessment concerns likelihood; it does not remove the potential consequences of successful exploitation.
What to update—and what to verify
Microsoft’s remediation is explicit:
For Microsoft Power Apps for Android, update to fixed build 3.26085.7 or later.
For enterprise IT teams, the practical takeaway is to track the application build on Android devices rather than treating completion of desktop patching as the success criterion for this advisory. The supplied affected-product mapping ties Microsoft Power Apps for Android directly to fixed build 3.26085.7.
A focused remediation workflow is:
- Identify relevant installations. Establish which users and managed devices run Microsoft Power Apps for Android.
- Deploy the application update. Use the organization’s normal application-update process to reach the fixed build or later.
- Verify the installed build. Check deployment results against 3.26085.7; issuing an update instruction is not the same as confirming installation.
- Reinforce link caution. Remind affected users to scrutinize unexpected links, consistent with the attack interaction Microsoft describes.
These workflow recommendations follow from the advisory’s product, fixed-build, and interaction details. Link awareness complements remediation; it does not replace it.
Bottom line: Microsoft has supplied a clear application-level fix for an Important remote code execution vulnerability. For administrators responsible for Microsoft Power Apps for Android, the concrete completion target is an installed build of 3.26085.7 or later.