Due to the increasing interdependencies of power networks (PNs) and communication networks (CNs) in cyber‐physical power systems (CPPSs), the interdependent networks tend to be more vulnerable since failures could propagate recursively between the two networks. However, there is little study on the vulnerability analysis of CPPSs considering unexpected disruptive events or adversarial attacks. Despite being a useful tool for evaluating cascading failures in interdependent networks, the topology‐based percolation theory does not apply to CPPSs as neglecting the propagation dynamics and power flow characteristics. To this end, this paper improves the percolation theory by modelling the failure propagation mechanism to assess the vulnerability of CPPSs. Firstly, a percolation‐based failure propagation simulator (PFPS) is developed, wherein the virus‐caused propagation dynamics of the cyber layer, flow‐based failure propagation mode of the physical layer, and multi‐state interdependences between the cyber layer and physical layer are incorporated. By considering the nodal states and flow‐related operating states, percolation equations and termination conditions of PFPS are formulated. Based on the calculation results of PFPS, metrics in terms of topological integrity, power supply reliability, and failure probability are constructed to quantify both system and component vulnerability. The effectiveness of the proposed method is validated by the test CPPSs.