Microsoft Power Automate Remote Code Execution Vulnerability

CVE-2025-21187 is a remote code execution vulnerability in Power Automate (rated Important, CVSS 7.8).

1 version

Microsoft id: CVE-2025-21187
Products: Power Automate
Severity: Important
Impact: Remote Code Execution
CVSS: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Exploited: No
Publicly disclosed: No
Exploitability: Exploitation Less Likely
Customer action required: Yes
Release: 2025-Jan
Assigned by: Microsoft
Weakness: CWE-94: Improper Control of Generation of Code ('Code Injection')
MSRC revision: 1.0
Status pages: Power Automate status
First captured by us: 13 Nov 2026, 15:47 UTC (from our first import of this list)
Microsoft last modified: 14 Jan 2025, 16:00 UTC
Source: Security updates · open the original at Microsoft

Microsoft's revision notes

According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?

Security updates, 16:00 UTC, 14 Jan 2025

One version so far. If Microsoft edits it, each change shows here with what was removed and added.

First version we captured · 15:47 UTC, 13 Nov
The text as we first saw it
Seen by us 15:47 UTC, 13 Nov · Microsoft's timestamp 16:00 UTC, 14 Jan 2025 · Microsoft's page

Last updated 13 Nov 2026, 15:47 UTC