7.8

CVE-2025-21187

Microsoft Power Automate Remote Code Execution Vulnerability

Data is provided by the National Vulnerability Database (NVD)
Microsoft ≫ Power Automate For Desktop Version >= 2.46 < 2.46.184.25013
Microsoft ≫ Power Automate For Desktop Version >= 2.47 < 2.47.126.25010
Microsoft ≫ Power Automate For Desktop Version >= 2.48 < 2.48.164.25010
Microsoft ≫ Power Automate For Desktop Version >= 2.49 < 2.49.182.25010
Microsoft ≫ Power Automate For Desktop Version >= 2.50 < 2.50.139.25010
Microsoft ≫ Power Automate For Desktop Version >= 2.51 < 2.51.349.24355
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.24% 0.474
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
secure@microsoft.com 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.