# CVE-2026-23652: Microsoft Power Pages command injection

Source: https://junglewise.ai/threats/cve-2026-23652-microsoft-power-pages-command-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-22. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-23652 · Severity: critical · CVSS 10 · Published 2026-05-22

Microsoft Power Pages, a platform used for creating and hosting external-facing business websites, contains a critical security flaw. An unauthorized attacker can remotely execute malicious commands on the system over the internet. This could lead to a total compromise of the service, including the theft of sensitive customer data and the disruption of hosted business websites.

Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-23652 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-23652 being exploited in the wild.

**How severe is CVE-2026-23652?** Critical severity, with a CVSS score of 10, published 22 May 2026.

**Which products and versions are affected?** Microsoft Power Pages.

**Is there a fix for CVE-2026-23652?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-23652 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-23652?** Check whether you run Microsoft Power Pages. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability (CWE-77) exists in Microsoft Power Pages due to the improper neutralization of special elements used in a command. The flaw allows an unauthenticated attacker to send specially crafted requests over the network to execute arbitrary code on the underlying infrastructure. With a CVSS score of 10.0, the attack requires no user interaction and no prior privileges. Successful exploitation results in a full compromise of confidentiality, integrity, and availability, with the impact extending beyond the immediate security scope of the affected component.

## Affected products

- Microsoft Power Pages

## Timeline

- 2026-05-22: disclosed
- 2026-05-22: advisory

## References

- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23652](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23652)

## Related threats

- [Microsoft Power Pages Improper Access Control Vulnerability](https://junglewise.ai/threats/cve-2025-24989-microsoft-power-pages-improper-access-control-vulnerability)