This vulnerability in Microsoft Power Automate for Desktop (version 1.0.0.0) involves the exposure of sensitive information to an unauthorized actor. Specifically, an attacker with authorized access can disclose sensitive data over a network. The CVSS 3.1 vector indicates the attack requires network access with low complexity and privileges, no user interaction, and impacts confidentiality with high severity but no impact on integrity or availability. Microsoft has published an official fix to remediate this vulnerability.

The vulnerability allows an attacker who already has some level of authorized access to disclose sensitive information over a network, potentially leading to confidentiality breaches. There is no impact on data integrity or system availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users of Microsoft Power Automate for Desktop version 1.0.0.0 should apply the provided patch as soon as possible to remediate this vulnerability. Refer to the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40374 for detailed patch information and installation instructions.