Power Automate For Desktop
Monthly
Information disclosure in Microsoft Power Automate for Desktop (all versions from 1.0.0.0 up to but not including 2.67) enables an authenticated, low-privileged attacker operating over the network to access sensitive data they are not authorized to view. The flaw, rooted in CWE-200 improper exposure of sensitive information, carries a CVSS 6.5 score reflecting high confidentiality impact with no integrity or availability consequence. No active exploitation has been confirmed - EPSS stands at 0.11% and CISA KEV listing is absent - but patch availability from Microsoft makes remediation straightforward.
Critical information disclosure vulnerability in Microsoft Power Automate that allows unauthenticated remote attackers to expose sensitive information and escalate privileges across a network without requiring user interaction. With a CVSS score of 9.8 and an unauthenticated attack vector, this vulnerability represents an immediate and severe risk to organizations using Power Automate; exploitation is likely being actively pursued given the severity metrics and network-accessible nature of the vulnerability.
Uncontrolled search path element in Power Automate allows an authorized attacker to disclose information over a network. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Microsoft Power Automate Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Information disclosure in Microsoft Power Automate for Desktop (all versions from 1.0.0.0 up to but not including 2.67) enables an authenticated, low-privileged attacker operating over the network to access sensitive data they are not authorized to view. The flaw, rooted in CWE-200 improper exposure of sensitive information, carries a CVSS 6.5 score reflecting high confidentiality impact with no integrity or availability consequence. No active exploitation has been confirmed - EPSS stands at 0.11% and CISA KEV listing is absent - but patch availability from Microsoft makes remediation straightforward.
Critical information disclosure vulnerability in Microsoft Power Automate that allows unauthenticated remote attackers to expose sensitive information and escalate privileges across a network without requiring user interaction. With a CVSS score of 9.8 and an unauthenticated attack vector, this vulnerability represents an immediate and severe risk to organizations using Power Automate; exploitation is likely being actively pursued given the severity metrics and network-accessible nature of the vulnerability.
Uncontrolled search path element in Power Automate allows an authorized attacker to disclose information over a network. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Microsoft Power Automate Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.