CVE-2026-23652 is a command injection flaw in Microsoft Power Pages with a CVSS score of 10.0, the maximum. The record says an unauthorized attacker can execute code over a network. The record gives no version range, so read the Microsoft Security Response Center entry to learn whether any action is required on your side.
What's affected
The record names Microsoft Power Pages and describes improper neutralization of special elements in a command, leading to code execution over a network by an unauthorized attacker.
It does not list versions or fixed builds. Power Pages is a Microsoft hosted service, and for hosted services the vendor often fixes the issue itself. We could not confirm from the page whether customers need to do anything, so we do not claim either way.
The Microsoft Security Response Center entry for CVE-2026-23652 is the place to check for current guidance.
How to check if you're exposed
Open the MSRC update guide entry for CVE-2026-23652 and read the sections on affected products, the fix and any customer action. If Microsoft states that no customer action is required, record that in your risk register and move on.
Then review your own Power Pages sites. List the sites in your tenant, who can publish them, and which ones accept input from anonymous visitors. Anything that is exposed to the internet and takes input deserves a look at its custom code, its connectors and its table permissions.
What to do now
- Read the MSRC entry and note any customer action it names.
- Inventory your Power Pages sites and their owners.
- Review who can edit and publish sites, and remove access that is not needed.
- Check site logs and tenant audit logs for activity that you cannot explain.
- Record the outcome for your compliance and vulnerability management records.
Why it matters
The record lists CWE-77 (Command Injection). Special characters in input are not neutralized before they reach a command, so a crafted request can add its own instructions. The vector shows network reach, low complexity, no privileges, no user interaction and a changed scope, which is how the score reaches 10.0.
Scores of 10.0 are rare. For a hosted service, however, the practical risk to customers depends on how quickly the vendor fixed it and whether any action is left to you. The record does not mark this CVE as a CISA Known Exploited Vulnerability and gives no sign of exploitation. Keep the entry in view and revisit it if Microsoft updates its guidance.
Quick check
Do I need to patch Power Pages myself?
The record does not say. Read the MSRC entry for customer action.
Why is the score 10.0?
The vector shows no privileges, no user interaction, network access and a changed scope with high impact on all three areas.
Sources
Last reviewed: 19 October 2026.
