CVE-2025-21187
Published: 14 January 2025
Summary
CVE-2025-21187 is a high-severity Code Injection (CWE-94) vulnerability in Microsoft Power Automate For Desktop. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked in the top 35.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the specific RCE vulnerability in Power Automate by applying patches from the MSRC update guide.
Enforces validation of inputs such as malicious files or workflows to prevent CWE-94 code injection exploitation.
Anti-malware scanning detects and blocks malicious files or payloads that trigger the user-interaction-based RCE.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables arbitrary code execution via malicious file opened by user (T1204.002) and subsequent command/script interpreter abuse (T1059) due to code injection (CWE-94).
NVD Description
Microsoft Power Automate Remote Code Execution Vulnerability
Deeper analysisAI
CVE-2025-21187 is a Remote Code Execution vulnerability in Microsoft Power Automate, published on 2025-01-14T18:15:31.187. It carries a CVSS v3.1 base score of 7.8, with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, and is associated with CWE-94 (code injection) and NVD-CWE-noinfo.
The vulnerability can be exploited by a local attacker with no required privileges, provided they can convince a user to perform some interaction, such as opening a malicious file or triggering a specific workflow. Successful exploitation enables arbitrary code execution in the context of the user, resulting in high impacts to confidentiality, integrity, and availability.
The Microsoft Security Response Center (MSRC) has published an update guide for this vulnerability at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21187, which provides details on mitigation and patching.
Details
- CWE(s)