Microsoft Power Pages Elevation of Privilege Vulnerability
CVE-2025-24989 is an elevation of privilege vulnerability in Microsoft Power Pages (rated Critical, CVSS 8.2). Microsoft reports that it is being exploited.
Exploited1 version
Facts
- Microsoft id
CVE-2025-24989- Status
- Exploited
- Products
- Microsoft Power Pages
- Severity
- Critical
- Impact
- Elevation of Privilege
- CVSS
- 8.2
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C
- Exploited
- Yes
- Publicly disclosed
- No
- Exploitability
- Exploitation Detected
- Customer action required
- Yes
- Release
- 2025-Feb
- Assigned by
- Microsoft
- Weakness
- CWE-284: Improper Access Control
- MSRC revision
- 1.1
- First captured by us
- (from our first import of this list)
- Microsoft last modified
- Source
- Security updates · open the original at Microsoft
Microsoft's revision notes
- Revision 1.0, 2025-02-19:
Information published.
- Revision 1.1, 2025-02-21:
Fixed a typographical error. This is an information change only.
Microsoft says
An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control.
What Microsoft changed
One version so far. If Microsoft edits it, each change shows here with what was removed and added.
First version we captured ·
As first seen: Exploited
- Status
- Exploited
Seen by us · Microsoft's timestamp · Microsoft's page