CVE-2026-65818 is a high severity (CVSS 8.5) server side request forgery in Microsoft Power Automate. Microsoft's record says an authorized attacker could elevate privileges over a network. Power Automate is a hosted service, so check Microsoft's advisory to see whether any customer action is listed.
What's affected
- Product: Microsoft Power Automate, part of the Power Platform.
- Weakness: CWE-918 server side request forgery.
- Severity: CVSS 3.1 8.5, vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. The attacker needs a low privilege account, and the scope is changed. - Fixed version: not applicable in the usual sense for a hosted service. The Microsoft page needs JavaScript and did not load for me, so check it for whether customer action is required.
How to check if you're exposed
Power Automate cloud flows run in Microsoft's service, so there is no package to inspect. What you can check is who is able to build flows and connect them to other systems.
In the Power Platform admin center, review which environments exist, who holds maker and admin roles, and which data loss prevention policies apply to HTTP and custom connectors. If the advisory lists a required customer action, follow it. If it says Microsoft has already fixed the service, record that and keep the access review as general hygiene.
What to do now
- Read the Microsoft advisory for CVE-2026-65818 and note whether any customer action is listed.
- Review maker and admin roles in each Power Platform environment and remove accounts that do not need them.
- Check data loss prevention policies for connectors that can reach internal addresses.
- Record the advisory outcome in your vulnerability register so the item can be closed.
Why it matters
Server side request forgery tricks a service into sending requests on the attacker's behalf, from inside the service's own network position. That position often has access that an outside user lacks, such as internal endpoints or cloud metadata. The vector here shows a changed scope, which matches the idea that the service reaches beyond its own boundary.
The attacker needs an authorized account, so the first control is limiting who can create automations. The record does not report exploitation and the CISA KEV flag is false.
Quick check
Is there anything to install?
Power Automate runs as a hosted service, so patching is usually done by Microsoft. Check the advisory to confirm that for this CVE.
Why still review maker roles?
The flaw needs an authorized account. Fewer accounts that can build flows means fewer people who could use a flaw like this.
Sources
- Microsoft Security Response Center entry (listed in the record; its page needs JavaScript, so I could not read build numbers from it)
- Gold record for CVE-2026-65818
Last reviewed: 19 October 2026.
