May 2026: Microsoft Power Automate Desktop Information Disclosure Vulnerability
CVE-2026-40374 Published on May 12, 2026
Microsoft Power Automate Desktop Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Power Automate allows an authorized attacker to disclose information over a network.
Weakness Type
What is an Information Disclosure Vulnerability?
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVE-2026-40374 has been classified to as an Information Disclosure vulnerability or weakness.
Products Associated with CVE-2026-40374
Want to know whenever a new CVE is published for Microsoft Power Automate For Desktop? stack.watch will email you.
Affected Versions
Microsoft Power Automate for Desktop:- Version 1.0.0.0 and below 2.67 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.