Vulnérabilité d'exécution de code à distance dans Microsoft Power Automate

Successful exploitation of CVE-2025-21187 allows an attacker to execute arbitrary code within the context of the Power Automate for Desktop process. This could involve downloading and executing malicious payloads, installing malware, or gaining persistent access to the system. The attacker could potentially steal sensitive data, modify system configurations, or even pivot to other systems on the network. Given Power Automate for Desktop's automation capabilities, an attacker could leverage this vulnerability to automate malicious actions across multiple endpoints, significantly expanding the blast radius.

Organizations heavily reliant on Power Automate for Desktop for unattended automation tasks are particularly at risk. This includes environments where automation flows interact with sensitive data or critical systems. Users with administrative privileges on systems running Power Automate for Desktop are also at higher risk, as they may be able to execute malicious code with elevated privileges.

• windows / supply-chain:

Get-Process -Name 'PowerAutomateDesktop.exe' -ErrorAction SilentlyContinue |
Where-Object {$_.Modules -match 'malicious_module_name'}

• windows / supply-chain:

Get-ScheduledTask | Where-Object {$_.TaskName -like '*PowerAutomate*'} | Format-List TaskName, Actions

• windows / supply-chain:

Get-WinEvent -LogName Application -FilterXPath '//Event[System[Provider[@Name='Microsoft-Windows-PowerAutomateDesktop']]]' | Format-List -Property TimeCreated, Message

1. 2025-01-14Disclosure

   disclosure

1. Réservé2024-12-05
2. Publiée2025-01-14
3. Modifiée2026-02-26
4. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2025-21187 is to upgrade to Power Automate for Desktop version 2.52.62.25009 or later. If upgrading immediately is not feasible, consider restricting network access to Power Automate for Desktop processes and carefully reviewing any unattended automation flows for suspicious activity. Implement application control policies to prevent the execution of unauthorized code. After upgrading, confirm the fix by attempting to trigger the vulnerable functionality and verifying that code execution is prevented.