CVE-2026-77897: Microsoft Power Automate For Desktop

High severity, CVSS 7.0. EPSS: 0.3% chance of exploitation in the next 30 days.

Relative path traversal in Power Automate allows an authorized attacker to elevate privileges locally.

Affected products

• Microsoft Power Automate For Desktop: before 2.71.115.26224 (fixed in 2.71.115.26224)

Published 2026-09-08. Last modified 2026-09-29.