Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Summary
If you use Power Automate for desktop versions 2.54 through 2.68, a Java automation security vulnerability might affect your machine. Learn how to protect your machine by installing a patched version or disabling the Power Automate Java sync service.
Machines with affected versions of Power Automate for desktop installed could allow a local Windows user to execute code with elevated privileges. Microsoft has issued a CVE-2026-77897 for this issue.
Important
If you disable the Power Automate Java sync service, you're not affected.
Solution
Choose one of the following two mitigations. Installing a patched version is the recommended option because it keeps Java automation fully functional.
Install patched versions of Power Automate for desktop (recommended)
Install one of the following patched versions of Power Automate for desktop:
Note
Versions 2.69 and later of Power Automate for desktop aren't vulnerable. For more information about how to keep installations current, see Automatic updates for Power Automate for desktop and Install Power Automate for desktop.
Disable the Java automation sync service
If you must stay on an unpatched version of Power Automate for desktop, disable the Power Automate Java sync service through Windows services (services.msc):
- Sign in to the machine as a local administrator.
- Select Start, enter
services.msc, and then open the Services console. - In the list of services, locate Power Automate Java sync service (service name
PADJavaSyncService). - Right-click the service, and then select Properties.
- Set Startup type to Disabled.
- If the service status is Running, select Stop.
- Select OK.
After you disable the service, Java automation might not work correctly if the Java JRE or JDK on the machine is updated. If that happens, you might have to manually run PAD.Java.Installer.Host.exe from the Power Automate for desktop installation folder, which is located at C:\Program Files (x86)\Power Automate Desktop\dotnet by default.