CVE-2024-49035: Microsoft Partner Center improper access control allows privilege elevation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or user interaction required, plus confirmed exploitation per CISA KEV, makes this an urgent internet-facing issue.

What it is

Partner.Microsoft.com contains an improper access control flaw (CWE-269) that lets an unauthenticated attacker elevate privileges over the network. Microsoft rates it 9.8 critical, and CISA added it to the Known Exploited Vulnerabilities catalog, so it is being exploited in the wild.

Impact

An unauthenticated attacker can gain elevated privileges on the Partner Center platform, potentially reaching data or functions reserved for higher-privileged accounts. The scope is limited to the affected service (CVSS scope unchanged), but confidentiality, integrity and availability impacts are all rated high.

Attack surface

Reachable over the network via Partner.Microsoft.com with no authentication and no user interaction required (AV:N/AC:L/PR:N/UI:N). Any internet client able to reach the service is a potential entry point.

Exploitation

Listed in CISA KEV since 2025-02-25 with a remediation due date of 2025-03-18, confirming known exploitation; EPSS 30-day probability is 0.013 (69th percentile), and no ransomware campaign use is recorded.

What to do

• Apply Microsoft's mitigations or fixes per the MSRC update guide for CVE-2024-49035, and follow BOD 22-01 guidance for cloud services.
• If no mitigation is available, discontinue use of the affected Partner Center functionality until it is fixed.
• Review Partner Center accounts and roles for unauthorized privilege changes or new high-privilege accounts.
• Restrict or monitor network access to Partner.Microsoft.com where operationally feasible.
• Track the CISA KEV due date (2025-03-18) to confirm remediation is completed.

Detection

• Audit Partner Center authentication and authorization logs for privilege-elevation events or role changes from unauthenticated or unexpected sources.
• Alert on anomalous access to Partner.Microsoft.com endpoints, especially requests that succeed without prior authentication.
• Correlate Partner Center activity with identity provider logs to spot new or modified privileged accounts.
• Monitor for indicators published by Microsoft and CISA related to this CVE.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.