CVE-2026-77897 Overview
CVE-2026-77897 is a relative path traversal vulnerability [CWE-23] in Microsoft Power Automate. An authenticated local attacker can leverage the flaw to elevate privileges on the affected system. Microsoft published the advisory through the Microsoft Security Response Center (MSRC) update guide.
The vulnerability requires local access and low privileges but has high attack complexity. Successful exploitation grants high impact to confidentiality, integrity, and availability. Power Automate desktop and cloud flow components that resolve file paths without proper canonicalization are the likely execution surface.
Critical Impact
A local authenticated attacker can escape intended directory boundaries in Power Automate and execute operations in higher-privileged contexts, compromising the host.
Affected Products
- Microsoft Power Automate (see Microsoft CVE-2026-77897 Update Guide for exact builds)
Discovery Timeline
- 2026-09-08 - CVE-2026-77897 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-77897
Vulnerability Analysis
The flaw is classified under [CWE-23] Relative Path Traversal. Power Automate accepts input that is used to construct a file path without fully normalizing sequences such as ..\ or ../. An attacker who is already authenticated on the local system supplies crafted path fragments that resolve outside the intended working directory.
Because Power Automate components run flows and connectors with elevated service context on Windows, writing or executing files outside the sandboxed directory produces privilege escalation. The MSRC guidance indicates the attack complexity is high, which suggests the exploit depends on race conditions, specific configuration states, or preconditions the attacker must arrange.
Root Cause
The root cause is improper sanitization of user-controlled path segments before they are joined with a trusted base directory. When the joined path is passed to file system APIs, the traversal characters redirect operations to attacker-chosen locations. Canonicalization checks that would reject paths escaping the base directory are missing or incomplete.
Attack Vector
Exploitation requires local access and a low-privileged authenticated session on a host running the vulnerable Power Automate component. The attacker crafts flow inputs, connector parameters, or artifact file names containing relative traversal sequences. The vulnerable code resolves the path into a directory writable by the higher-privileged Power Automate service, enabling file overwrite, DLL planting, or arbitrary write primitives that escalate privileges.
No public proof-of-concept is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.27%.
For technical specifics, see the Microsoft CVE-2026-77897 Update Guide.
Detection Methods for CVE-2026-77897
Indicators of Compromise
- Unexpected files written by the Power Automate service account outside its standard installation and profile directories.
- Flow definitions, connector configurations, or artifact names containing ..\, ../, or URL-encoded traversal sequences such as %2e%2e%5c.
- New or modified DLLs adjacent to Power Automate executables that were not delivered by an authorized installer or update.
Detection Strategies
- Audit Power Automate flow input parameters and connector arguments for path-like values containing traversal metacharacters.
- Monitor Windows Sysmon Event ID 11 (FileCreate) and Event ID 1 (ProcessCreate) for Power Automate processes writing to system directories or launching child processes from unexpected paths.
- Correlate local logon events with subsequent privileged file writes performed by the Power Automate service to identify escalation chains.
Monitoring Recommendations
- Enable command-line and PowerShell script block logging on hosts running Power Automate desktop to capture flow execution context.
- Forward Power Automate application logs and Windows Security logs to a centralized analytics platform for correlation across hosts.
- Baseline the file system footprint of the Power Automate installation directory and alert on deviations.
How to Mitigate CVE-2026-77897
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft CVE-2026-77897 Update Guide as soon as it is available in your environment.
- Inventory all hosts running Power Automate desktop and the Power Automate service, and prioritize patching systems where non-administrative users have interactive logon rights.
- Restrict who can author and run local flows to trusted administrators until patching is complete.
Patch Information
Microsoft has published the fix through the MSRC update guide for CVE-2026-77897. Refer to the Microsoft CVE-2026-77897 Update Guide for the specific KB articles, affected builds, and fixed versions applicable to your Power Automate deployment.
Workarounds
- Remove local administrator equivalence from users who only need to run Power Automate flows.
- Enforce application control policies (Windows Defender Application Control or AppLocker) to prevent unauthorized DLLs and executables from loading in the Power Automate installation directory.
- Restrict NTFS permissions on directories writable by the Power Automate service so standard users cannot influence files consumed at elevated context.
# Example: restrict write access on Power Automate working directory (run as admin)
icacls "C:\Program Files (x86)\Power Automate Desktop" /inheritance:r
icacls "C:\Program Files (x86)\Power Automate Desktop" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
