What is the CVSS score of CVE-2026-40374?

CVE-2026-40374 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-40374?

Yes, a patch is available for CVE-2026-40374. Update the affected software to the latest version immediately.

Power Automate Desktop CVE-2026-40374

EUVD-2026-29653 MEDIUM

Information Exposure (CWE-200)

2026-05-12 microsoft

GHSA-8fxf-7qxm-gqm9

Information Disclosure Microsoft Power Automate For Desktop

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

ENISA EUVD

HIGH

qualitative

vuln.today AI

6.5 MEDIUM

Network-accessible disclosure requiring low-privilege authentication; no integrity or availability impact; scope unchanged as breach is contained to the application component.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 22:07 vuln.today

CVE Published

May 12, 2026 - 16:58 nvd

MEDIUM 6.5

DescriptionCVE.org

Exposure of sensitive information to an unauthorized actor in Power Automate allows an authorized attacker to disclose information over a network.

AnalysisAI

Information disclosure in Microsoft Power Automate for Desktop (all versions from 1.0.0.0 up to but not including 2.67) enables an authenticated, low-privileged attacker operating over the network to access sensitive data they are not authorized to view. The flaw, rooted in CWE-200 improper exposure of sensitive information, carries a CVSS 6.5 score reflecting high confidentiality impact with no integrity or availability consequence. No active exploitation has been confirmed - EPSS stands at 0.11% and CISA KEV listing is absent - but patch availability from Microsoft makes remediation straightforward.

Technical ContextAI

Power Automate for Desktop is Microsoft's robotic process automation (RPA) client application, identified via CPE cpe:2.3:a:microsoft:power_automate_for_desktop:*:*:*:*:*:*:*:*. It enables users to automate desktop and web-based workflows, often interacting with sensitive business data, credentials, and enterprise system integrations. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) indicates that the application fails to properly restrict what data is accessible or transmitted to authenticated users, allowing data intended for more privileged contexts to leak across a network channel. Given the RPA nature of the product, the sensitive information at risk may include workflow configurations, stored credentials, or business process data.

RemediationAI

Upgrade Microsoft Power Automate for Desktop to version 2.67 or later, which contains the vendor-released patch per the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40374. Organizations should prioritize patching in environments where Power Automate workflows handle sensitive data such as credentials, PII, or proprietary business process information, as these represent the highest-impact exposure scenarios. If immediate patching is not feasible, restricting network access to Power Automate for Desktop endpoints - for example, via host-based firewall rules limiting which authenticated accounts or subnets can reach the application's network-facing components - can reduce the attack surface, though this may impact legitimate automation workflows. Additional monitoring of Power Automate Desktop network traffic for anomalous data egress can serve as a detective control in the interim.