CVE-2026-65818 Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a network

Description

Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a network.

Affected products and versions

Product	Affected versions	Fixed in
Microsoft Power Platform	Versions not published

Other CVEs of Microsoft Power Platform

The 4 CVEs of Microsoft Power Platform →

CVE-2024-38190 Missing authorization in Power Platform allows an unauthenticated attacker to view sensitive information through a… 8.6 High CVE-2024-35260 An authenticated attacker can exploit an untrusted search path vulnerability in Microsoft Dataverse to execute code over… 8.0 High CVE-2023-36019 Microsoft Power Platform Connector Spoofing Vulnerability 9.6 Critical