Microsoft Power Automate For Desktop — known CVE vulnerabilities

Every CVE whose affected-product data names Microsoft Power Automate For Desktop, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (4)

• CVE-2025-47966 — CVSS 9.8 (critical): Exposure of sensitive information to an unauthorized actor in Power Automate allows an unauthorized attacker to elevate privileges over a…
• CVE-2025-21187 — CVSS 7.8 (high): Microsoft Power Automate Remote Code Execution Vulnerability
• CVE-2026-40374 — CVSS 6.5 (medium): Exposure of sensitive information to an unauthorized actor in Power Automate allows an authorized attacker to disclose information over a…
• CVE-2025-29817 — CVSS 5.7 (medium): Uncontrolled search path element in Power Automate allows an authorized attacker to disclose information over a network.