Microsoft Power Automate for Desktop < 2.71.115.26224 Elevation of Privilege (September 2026)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(345594);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/16");

  script_cve_id("CVE-2026-77897");
  script_xref(name:"IAVA", value:"2026-A-0970");

  script_name(english:"Microsoft Power Automate for Desktop < 2.71.115.26224 Elevation of Privilege (September 2026)");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote Windows host is affected by an elevation of privilege vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Microsoft Power Automate for desktop installed on the remote Windows host is prior to 2.71.115.26224. It
is, therefore, affected by an elevation of privilege vulnerability. Relative path traversal in Power Automate allows an
authorized attacker to elevate privileges locally.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77897");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Microsoft Power Automate for desktop version 2.71.115.26224 or later.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-77897");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"x-cpe:/a:microsoft:power_automate_for_desktop");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("microsoft_power_automate_for_desktop_installed.nbin");
  script_require_keys("installed_sw/Microsoft Power Automate for desktop", "SMB/Registry/Enumerated");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Microsoft Power Automate for desktop', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        { 'fixed_version': '2.71.115.26224' }
      ]
    }
  ]
};
var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);