What’s Vulnerable › Vulnerabilities
CVE-2024-43479: Microsoft Power Automate Desktop Remote Code Execution Vulnerability
- Severity: high (CVSS 8.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.9% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-09-10 · updated 2026-08-10
- Weakness: CWE-284
Description
Microsoft Power Automate Desktop Remote Code Execution Vulnerability
Affected products
- Microsoft Power Automate: from 2.41 before 2.41.178.24249; from 2.42 before 2.42.331.24249; from 2.43 before 2.43.249.24249; from 2.44 before 2.44.55.24249; from 2.45 before 2.45.404.24249; from 2.46 before 2.46.181.24249 — fixed in 2.41.178.24249, 2.42.331.24249, 2.43.249.24249, 2.44.55.24249, 2.45.404.24249, 2.46.181.24249
- Microsoft Power Automate for Desktop: from 1.0.0.0 before 2.47.119.24249 — fixed in 2.47.119.24249
How to fix
Upgrade to a fixed version: Microsoft Power Automate 2.41.178.24249, 2.42.331.24249, 2.43.249.24249, 2.44.55.24249; Microsoft Power Automate for Desktop 2.47.119.24249. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-43479 or the next vulnerability affects your stack