CVE-2026-77897: CWE-23: Relative Path Traversal in Microsoft Power Automate agent for virtual desktops

This vulnerability, identified as CWE-23 (Relative Path Traversal), exists in the Microsoft Power Automate agent for virtual desktops. It allows an attacker with local authorized access to exploit relative path traversal to escalate privileges on the affected system. The CVSS 3.1 score is 7.0, indicating high severity, with attack vector local, attack complexity high, privileges required low, no user interaction, and impacts to confidentiality, integrity, and availability. Microsoft has published an official fix for this issue.

An authorized local attacker can leverage this vulnerability to elevate their privileges on the affected system, potentially gaining higher-level access than intended. This can compromise confidentiality, integrity, and availability of the system where the Power Automate agent is installed.

An official fix is available from Microsoft. Users should apply the patch provided by Microsoft to affected versions of the Power Automate agent for virtual desktops. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77897 for detailed remediation instructions.