Microsoft reports critical flaw in Power Automate
Take action: You don't need to do anything about this flaw. It's already patched. But be aware that the provider had a flaw. If you have an Enterprise account, reach out for more details about any possible breaches that may have affected you.
Learn More
Microsoft is reporting a critical security vulnerability in its Power Automate platform. Microsoft Power Automate is a low-code cloud-based platform that helps organizations improve productivity by automating repetitive, time-consuming tasks and creating intelligent automations based on generative AI.
The flaw is tracked as CVE-2025-47966 (CVSS score 9.8) and Microsoft Power Automate, also known as Power Automate Desktop. Microsoft did not provide details about the vulnerability other than it enables threat actors to access sensitive information and subsequently escalate their privileges across the target network, potentially leading to complete compromise of affected systems.
Microsoft has implemented server-side patches that require no customer intervention. "The vulnerability documented by this CVE does not require any customer action to fix," writes Microsoft, as the vulnerability has already been patched by developers on Microsoft servers.
It's not clear whether anyone has exploited this flaw before it was patched.
