CVE-2026-77897: Microsoft Power Automate Desktop Elevation of Privilege Vulnerability
Microsoft Power Automate Desktop Elevation of Privilege Vulnerability
Other sources
Relative path traversal in Power Automate allows an authorized attacker to elevate privileges locally.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.71.115.26224
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Systems running Microsoft Power Automate for Desktop or the Microsoft Power Automate agent for virtual desktops are in scope. Exploitation is local rather than remote.
What level of access does an attacker need?
An attacker must already be authorized and have local access to the affected system. No user interaction is required.
What is the likely impact of successful exploitation?
Successful exploitation can allow local privilege elevation. The supplied vector indicates high potential impact to confidentiality, integrity, and availability.