Power Automate For Desktop
Monthly
Local privilege escalation in Microsoft Power Automate for Desktop and Power Automate agent for virtual desktops (all versions before 2.71.115.26224) is achievable via a relative path traversal flaw (CWE-23). An authenticated local user with low privileges can exploit improperly sanitized file path construction within Power Automate's RPA engine or agent service - which operates at elevated privilege - to write to or execute from an unintended directory, achieving full local privilege escalation. No public exploit code and no CISA KEV listing exist at time of analysis; vendor patch is available at version 2.71.115.26224.
Information disclosure in Microsoft Power Automate for Desktop (all versions from 1.0.0.0 up to but not including 2.67) enables an authenticated, low-privileged attacker operating over the network to access sensitive data they are not authorized to view. The flaw, rooted in CWE-200 improper exposure of sensitive information, carries a CVSS 6.5 score reflecting high confidentiality impact with no integrity or availability consequence. No active exploitation has been confirmed - EPSS stands at 0.11% and CISA KEV listing is absent - but patch availability from Microsoft makes remediation straightforward.
Critical information disclosure vulnerability in Microsoft Power Automate that allows unauthenticated remote attackers to expose sensitive information and escalate privileges across a network without requiring user interaction. With a CVSS score of 9.8 and an unauthenticated attack vector, this vulnerability represents an immediate and severe risk to organizations using Power Automate; exploitation is likely being actively pursued given the severity metrics and network-accessible nature of the vulnerability.
Uncontrolled search path element in Power Automate allows an authorized attacker to disclose information over a network. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Microsoft Power Automate Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Local privilege escalation in Microsoft Power Automate for Desktop and Power Automate agent for virtual desktops (all versions before 2.71.115.26224) is achievable via a relative path traversal flaw (CWE-23). An authenticated local user with low privileges can exploit improperly sanitized file path construction within Power Automate's RPA engine or agent service - which operates at elevated privilege - to write to or execute from an unintended directory, achieving full local privilege escalation. No public exploit code and no CISA KEV listing exist at time of analysis; vendor patch is available at version 2.71.115.26224.
Information disclosure in Microsoft Power Automate for Desktop (all versions from 1.0.0.0 up to but not including 2.67) enables an authenticated, low-privileged attacker operating over the network to access sensitive data they are not authorized to view. The flaw, rooted in CWE-200 improper exposure of sensitive information, carries a CVSS 6.5 score reflecting high confidentiality impact with no integrity or availability consequence. No active exploitation has been confirmed - EPSS stands at 0.11% and CISA KEV listing is absent - but patch availability from Microsoft makes remediation straightforward.
Critical information disclosure vulnerability in Microsoft Power Automate that allows unauthenticated remote attackers to expose sensitive information and escalate privileges across a network without requiring user interaction. With a CVSS score of 9.8 and an unauthenticated attack vector, this vulnerability represents an immediate and severe risk to organizations using Power Automate; exploitation is likely being actively pursued given the severity metrics and network-accessible nature of the vulnerability.
Uncontrolled search path element in Power Automate allows an authorized attacker to disclose information over a network. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Microsoft Power Automate Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.