This vulnerability in Microsoft Power Automate for Desktop (version 1.0.0.0) involves exposure of sensitive information to unauthorized actors. An attacker with authorized access can disclose sensitive data over a network. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, high confidentiality impact, no integrity or availability impact, and an official fix remediation level. Microsoft has published an official fix for this vulnerability.

The vulnerability allows an attacker who already has some level of authorized access to disclose sensitive information over the network, potentially leading to confidentiality breaches. There is no impact on integrity or availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users of Power Automate for Desktop version 1.0.0.0 should apply the vendor-provided patch as detailed in the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40374 to remediate this vulnerability.