6.5
Medium
CVE-2026-40374 Exposure of sensitive information to an unauthorized actor in Power Automate allows an authorized attacker to disclose…
Description
Exposure of sensitive information to an unauthorized actor in Power Automate allows an authorized attacker to disclose information over a network.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Power Automate for Desktop 1.0 | 1.0.0.0 → < 2.67 | 2.67 |
References
- Microsoft Power Automate Desktop Information Disclosure Vulnerability msrc.microsoft.com
Timeline
- Published
- Last modified
Other CVEs of Power Automate for Desktop
The 6 CVEs of Power Automate for Desktop →
CVE-2026-77897
Relative path traversal in Power Automate allows an authorized attacker to elevate privileges locally
7.0
High
CVE-2025-47966
Exposure of sensitive information to an unauthorized actor in Power Automate allows an unauthorized attacker to…
9.8
Critical
CVE-2025-29817
Uncontrolled search path element in Power Automate allows an authorized attacker to disclose information over a network
5.7
Medium
CVE-2025-21187
Microsoft Power Automate Remote Code Execution Vulnerability
7.8
High