CVEFinder.io

CVE-2025-21187

⚠️ high
🔍 Scan for this CVE
Summary

Microsoft Power Automate Remote Code Execution Vulnerability

CVSS Score
7.8
High
EPSS Score
0.6
Exploit Probability
Published Date
2025-01-14
First Seen: 2026-01-04
📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 69.7% of all 321,566 vulnerabilities in our database.

#97,378
Above average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jan 15, 2025
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
SSVC data provided by CISA
Last Modified 2025-02-05
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE IDs (Weakness Types)
CWE-94

📦 Affected Products 6

Vendor Product Status Affected Versions
microsoft power_automate_for_desktop Affected
≥ 2.46 < 2.46.184.25013
microsoft power_automate_for_desktop Affected
≥ 2.47 < 2.47.126.25010
microsoft power_automate_for_desktop Affected
≥ 2.48 < 2.48.164.25010
microsoft power_automate_for_desktop Affected
≥ 2.49 < 2.49.182.25010
microsoft power_automate_for_desktop Affected
≥ 2.50 < 2.50.139.25010
microsoft power_automate_for_desktop Affected
≥ 2.51 < 2.51.349.24355

🔗 References 1

https://msrc.microsoft.com/update-guide/vulnerabilit...
Vendor Advisory

🔗 Related CVEs 3

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-40374 🔶 medium 6.5 0.1 Exposure of sensitive information to an unauthorized actor in Power Automate allows an authorized attacker to disclose i... 2026-05-12
CVE-2025-47966 ⛔ critical 9.8 0.3 Exposure of sensitive information to an unauthorized actor in Power Automate allows an unauthorized attacker to elevate ... 2025-06-05
CVE-2025-29817 🔶 medium 5.7 0.5 Uncontrolled search path element in Power Automate allows an authorized attacker to disclose information over a network. 2025-04-15
These CVEs affect the same products