CVE-2025-24989highunder attackCWE-284

CVE-2025-24989: high-severity vulnerability in Microsoft Power Pages

Microsoft Power Pages Elevation of Privilege Vulnerability

Published · Updated

Follow this CVE+ Monitor Microsoft Power Pages

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

51Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.2epss 1.6%
from disclosure to weapon
Published on NVDFeb 19
CISA KEV+2d
Action required by CISAfederal deadline: 2025-03-14

Apply mitigations per vendor instructions, follow BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Microsoft Power Pages has a flaw in its access control that lets attackers gain higher privileges over the network and bypass user registration restrictions. This means unauthorized people could gain access they shouldn't have.

Technical detail

An improper access control vulnerability in Power Pages allows remote attackers to elevate privileges by bypassing registration control mechanisms. The vulnerability stems from insufficient authorization checks on privilege escalation endpoints, enabling unauthenticated or low-privileged users to access restricted functionality without proper validation.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update addressed the registration control bypass. Affected customers have been given instructions on reviewing their sites for potential exploitation and clean up methods. If you've not been notified this vulnerability does not affect you.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C
Affected products
Microsoft · Microsoft Power Pages
Related CVEs — Microsoft Power Pages

In the same product, most dangerous first.

CVE-2025-47733CRITICALMicrosoft Power Apps Information Disclosure VulnerabilityEPSS 2.0%CVE-2026-23652CRITICALMicrosoft Power Pages Remote Code Execution VulnerabilityEPSS 0.6%