CVE-2024-49035highunder attackCWE-269

CVE-2024-49035: high-severity vulnerability in Microsoft Partner Center

Partner.Microsoft.Com Elevation of Privilege Vulnerability

Published · Updated

Follow this CVE+ Monitor Microsoft Partner Center

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

51Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.7epss 1.3%
from disclosure to weapon
Published on NVDNov 26
CISA KEV+91d
Action required by CISAfederal deadline: 2025-03-18

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

An attacker without an account can gain unauthorized higher-level access on Partner.Microsoft.com over the network. This is dangerous because it allows them to perform actions they shouldn't be allowed to do, potentially accessing sensitive partner information or making unauthorized changes.

Technical detail

An improper access control vulnerability (CWE-269) in Partner.Microsoft.com permits unauthenticated remote attackers to escalate privileges without authentication. The vulnerability stems from insufficient validation of access permissions, enabling attackers to perform operations reserved for authenticated or higher-privileged users.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C
Affected products
Microsoft · Microsoft Partner Center
Related CVEs — Microsoft Partner Center

In the same product, most dangerous first.

CVE-2025-29814CRITICALMicrosoft Partner Center Elevation of Privilege VulnerabilityEPSS 2.3%CVE-2026-69558HIGHMicrosoft Partner Center Information Disclosure VulnerabilityEPSS 1.0%CVE-2025-65041CRITICALMicrosoft Partner Center Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2026-96207CRITICALMicrosoft Partner Center Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2026-34327HIGHMicrosoft Partner Center Spoofing VulnerabilityEPSS 0.6%CVE-2026-24303CRITICALMicrosoft Partner Center Elevation of Privilege VulnerabilityEPSS 0.4%