CVE-2025-24989: Microsoft Power Pages improper access control allows privilege elevation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction, plus confirmed exploitation in the CISA KEV catalog, makes this a top remediation priority despite the low EPSS score.

What it is

Power Pages contains an improper access control flaw that lets an unauthorized network attacker elevate privileges, potentially bypassing the user registration control. Microsoft states the vulnerability has already been mitigated in the service and affected customers were notified, so this record describes a service-side fix rather than a customer-applied patch.

Impact

An unauthenticated attacker can bypass registration controls and elevate privileges, gaining high confidentiality, integrity and availability impact on the affected site. This can expose or corrupt site data and allow unauthorized administrative-level actions.

Attack surface

Reachable over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The flaw is in the Power Pages service itself, so any exposed site using the affected registration control is a potential target.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2025-02-21, indicating known exploitation in the wild. EPSS is low at roughly 1.6% (74.9th percentile), but the KEV listing and vendor notification of affected customers outweigh that signal.

What to do

• Confirm whether Microsoft notified you as an affected customer; if not, the vendor states you are not affected.
• Apply the service-side mitigation Microsoft already deployed and follow the vendor's remediation guidance.
• Review Power Pages sites for signs of unauthorized registration or privilege changes and perform the cleanup steps Microsoft provided.
• If mitigations are unavailable, follow BOD 22-01 guidance for cloud services or discontinue use of the product.
• Track the CISA KEV due date of 2025-03-14 for federal remediation timelines.

Detection

• Audit Power Pages registration and authentication logs for accounts created outside expected registration flows.
• Review site user and role assignments for unexpected privilege grants or new administrative accounts.
• Monitor for anomalous access patterns to Power Pages sites that bypass normal registration controls.
• Compare current site configuration and user lists against known-good baselines to spot unauthorized changes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.