by Kastro
Paper/Archive/CVE-2025-24989

CVE-2025-24989

Microsoft Microsoft Power Pages — Microsoft Power Pages Elevation of Privilege Vulnerability

KEV · due 14 MarEPSS 2%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
95
CVSS 9.8 (NVD)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 76.1.761 × 2015.2Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update addressed the registration control bypass. Affected customers have been given instructions on reviewing their sites for potential exploitation and clean up methods. If you've not been notified this vulnerability does not affect you.

Affected

ProductAffectedFixed inSource
Microsoft Power Pages-–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
microsoft (CNA)8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C
CISA ADPSSVCExploitation: active · Automatable: no · Technical impact: total

References

patchmsrc.microsoft.com/update-guide/vulnerability/CVE-2025-24989refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24989kevcisa.gov/known-exploited-vulnerabilities-catalog