9.8
Critical
CVE-2025-47966 Exposure of sensitive information to an unauthorized actor in Power Automate allows an unauthorized attacker to…
Description
Exposure of sensitive information to an unauthorized actor in Power Automate allows an unauthorized attacker to elevate privileges over a network.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Power Automate for Desktop | Versions not published |
References
- Power Automate Elevation of Privilege Vulnerability msrc.microsoft.com
Timeline
- Published
- Last modified
Other CVEs of Power Automate for Desktop
The 6 CVEs of Power Automate for Desktop →
CVE-2026-77897
Relative path traversal in Power Automate allows an authorized attacker to elevate privileges locally
7.0
High
CVE-2026-40374
Exposure of sensitive information to an unauthorized actor in Power Automate allows an authorized attacker to disclose…
6.5
Medium
CVE-2025-29817
Uncontrolled search path element in Power Automate allows an authorized attacker to disclose information over a network
5.7
Medium
CVE-2025-21187
Microsoft Power Automate Remote Code Execution Vulnerability
7.8
High