CVE-2025-24989 KEV
8.2
HIGH · CVSS 3.1 · EPSS 1.6% (pctl 75)
Patch first
On CISA KEV — known exploited in the wild, due 2025-03-14.
Description
An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update addressed the registration control bypass. Affected customers have been given instructions on reviewing their sites for potential exploitation and clean up methods. If you've not been notified this vulnerability does not affect you.
Scoring
| CVSS | 8.2 (HIGH, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N |
| EPSS | 1.62% — more likely to be exploited than 75% of all CVEs |
| Weakness | CWE-284 |
| On CISA KEV | yes — remediate by 2025-03-14 |
| Public exploit | none known |
| Published | 2025-02-19 |
| Last modified | 2026-06-17 |
CISA KEV
| Name | Microsoft Power Pages Improper Access Control Vulnerability |
|---|---|
| Added | 2025-02-21 |
| Due | 2025-03-14 |
| Vendor / product | Microsoft / Power Pages |
| Ransomware use | none reported |
Affected (1)
| Vendor | Product |
|---|---|
| microsoft | power pages |
References
→ the Explorer · watch your stack · NVD