Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.0
CVE-2026-77897: Power Automate Desktop can let local attackers gain admin rights
CVE-2026-77897 · published 1 month ago
Summary
Power Automate Desktop and its virtual‑desktop agent on Windows can be fooled by a specially crafted file path. This lets a user who already has access to the computer run actions with administrator‑level rights. Install the latest Microsoft updates for Power Automate as soon as they are released.
What to do
- Update microsoft power automate agent for virtual desktops to version 2.71.115.26224 or later.
- Update microsoft power automate for desktop to version 2.71.115.26224 or later.
- Update microsoft power_automate_for_desktop to version 2.71.115.26224 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | power automate agent for virtual desktops | < 2.71.115.26224 |
| microsoft | power automate for desktop | < 2.71.115.26224 |
| microsoft | power_automate_for_desktop |
< 2.71.115.26224 cpe:2.3:a:microsoft:power_automate_for_desktop:*:*:*:*:*:*:*:* |
Original advisory text
Microsoft Power Automate Desktop Elevation of Privilege Vulnerability
Relative path traversal in Power Automate allows an authorized attacker to elevate privileges locally.
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77897 vendor-advisory patch
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-23Relative Path Traversal
Timeline
Published8 Sep 2026
Updated3 Nov 2026
First seen8 Sep 2026
Track software like this
Free during beta