CVE-2025-24989
Microsoft Power Pages Improper Access Control Vulnerability
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 14 March 2025). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update addressed the registration control bypass. Affected customers have been given instructions on reviewing their sites for potential exploitation and clean up methods. If you've not been notified this vulnerability does not affect you.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.62% probability · 76th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Listed 21 February 2025 · due 14 March 2025
- Weakness
- CWE-284
- Affected
- microsoft/power pages
- Source
- secure@microsoft.com
EPSS 1.6% since 30 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
CISA notes
Apply mitigations per vendor instructions, follow BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-24989 ; https://nvd.nist.gov/vuln/detail/CVE-2025-24989
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24989Patch, Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24989US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.