CVE-2026-23652 - Microsoft Power Pages Remote Code Execution Vulnerability

Back Back to CVE browser

CRITICAL

Microsoft Power Pages Remote Code Execution Vulnerability

Published May 22, 2026

10.0

CRITICAL

CVSS 3.1

EPSS 0.58%

Description

Improper neutralization of special elements used in a command ('command injection') in Microsoft Power Pages allows an unauthorized attacker to execute code over a network.

Affected products

Vendor Microsoft Product Microsoft Power Pages Default
n/a

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microsoft

Microsoft Power Pages

n/a

Version	Status	Constraints

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-77

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-31508
Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23652
vendor-advisorypatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-31508		Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23652		vendor-advisorypatchVendor Advisory