PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-40374 Microsoft CVE debrief

A medium-severity information disclosure vulnerability in Microsoft Power Automate for Desktop allows an authenticated attacker to expose sensitive data over a network. The vulnerability, published by NVD on May 12, 2026 and last modified on May 19, 2026, stems from improper exposure of sensitive information to unauthorized actors (CWE-200). Affected versions are those prior to 2.67. Microsoft has released a vendor advisory with remediation guidance. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates network-based attack vector with low attack complexity, requiring low privileges but no user interaction, resulting in high confidentiality impact with no integrity or availability impact. No known exploitation in the wild or ransomware campaign use has been documented, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor
Microsoft
Product
Power Automate for Desktop
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-05-19
Advisory published
2026-05-12
Advisory updated
2026-05-19

Who should care

Organizations using Microsoft Power Automate for Desktop for business process automation, particularly those handling sensitive data in automated workflows. Security teams responsible for Microsoft 365 and Power Platform governance should prioritize patching. Compliance officers in regulated industries should assess potential data exposure risks from unpatched installations.

Technical summary

The vulnerability exists in Microsoft Power Automate for Desktop versions prior to 2.67. An authenticated attacker with low privileges can exploit this flaw over a network to disclose sensitive information. The root cause is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The attack requires no user interaction and has low complexity, making it relatively straightforward to exploit once authenticated access is obtained. The confidentiality impact is rated high, though integrity and availability are unaffected.

Defensive priority

medium

Recommended defensive actions

  • Update Microsoft Power Automate for Desktop to version 2.67 or later to remediate this information disclosure vulnerability
  • Review network segmentation and access controls for Power Automate deployments to limit exposure of sensitive workflow data
  • Monitor Microsoft Security Response Center advisories for additional guidance or defense-in-depth recommendations
  • Assess Power Automate flows for sensitive data handling and implement least-privilege access principles for automation accounts

Evidence notes

Vendor advisory confirms affected product and fixed version. NVD analysis provides CVSS scoring and CPE criteria. No KEV entry or exploitation reports identified.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-40374 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-40374

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-40374 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-40374

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.