Power Automate For Desktop EUVD-2025-17028

This vulnerability presents exceptionally high real-world risk across multiple threat assessment frameworks. CVSS 9.8 with AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates complete compromise potential without authentication or user interaction—the most dangerous profile. The unauthenticated and network-accessible attack surface (AV:N, PR:N) makes this exploitable at scale by any internet-connected attacker. CWE-200 information disclosure combined with privilege escalation capability suggests attackers can leak sensitive credentials or tokens to pivot into higher-privileged contexts. The vulnerability's presence in a widely-deployed SaaS platform (Power Automate is part of Microsoft 365 standard deployments) amplifies impact across enterprise environments. Without additional context on EPSS score or KEV/CISA Known Exploited Vulnerabilities status from current threat intelligence feeds, the CVSS and attack vector alone warrant treating this as a critical priority requiring immediate patching. Organizations should assume exploitation is occurring or imminent given the straightforward attack requirements.

An attacker discovers or uses publicly available information about the Power Automate API endpoint flaw. Without requiring authentication, the attacker sends a crafted HTTP request to the vulnerable endpoint that exposes sensitive information—such as stored API connection credentials, OAuth tokens, or user/system credentials cached in Power Automate configurations. With this leaked information, the attacker escalates privileges by impersonating service accounts or using exposed tokens to access downstream systems (SharePoint, Exchange, SQL databases, etc.) that the Power Automate service account has permissions for. In a real-world scenario, an attacker could automate this exploitation across multiple organizations' Power Automate instances, harvesting credentials at scale. The attack requires no user interaction and can be launched remotely from any internet-connected location, making it easily weaponized by both automated scanners and targeted attack campaigns.