CVE-2025-21187

CVE-2025-21187 is a Remote Code Execution vulnerability in Microsoft Power Automate, published on 2025-01-14T18:15:31.187. It carries a CVSS v3.1 base score of 7.8, with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, and is associated with CWE-94 (code injection) and NVD-CWE-noinfo.

The vulnerability can be exploited by a local attacker with no required privileges, provided they can convince a user to perform some interaction, such as opening a malicious file or triggering a specific workflow. Successful exploitation enables arbitrary code execution in the context of the user, resulting in high impacts to confidentiality, integrity, and availability.

The Microsoft Security Response Center (MSRC) has published an update guide for this vulnerability at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21187, which provides details on mitigation and patching.