PT-2026-40206 · Microsoft · Power Automate

Published 2026-05-12 · Updated 2026-05-15 · CVE-2026-40374

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Power Automate (affected versions not specified)

Description Insufficient protection of service data in Power Automate for Desktop allows an authorized attacker to disclose sensitive information over a network.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2026-06874

CVE-2026-40374

Affected Products

Power Automate

References · 4

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40374 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40374 · Security Note
• https://bdu.fstec.ru/vul/2026-06874 · Security Note
• https://twitter.com/f1tym1/status/2055376258737819745 · Twitter Post