CVE-2025-24989
Microsoft Power Pages Improper Access Control Vulnerability
Microsoft Power Pages
An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update addressed the registration control bypass. Affected customers have been given instructions on reviewing their sites for potential exploitation and clean up methods. If you've not been notified this vulnerability does not affect you.
Exploitation status
CISA Known Exploited Vulnerabilities
Listed by CISA on 21 February 2025. US federal agencies were required to remediate it by 14 March 2025.
EPSS — exploitation probability
FIRST puts the probability of exploitation activity in the next 30 days at 1.6%, which is higher than 75.4% of all scored vulnerabilities. EPSS is a forecast of activity, not a measure of severity, and it is rescored daily.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Frequently asked questions
Is CVE-2025-24989 being exploited by ransomware groups?
No ransomware group in this database is currently recorded as exploiting CVE-2025-24989.
What does CVE-2025-24989 affect?
CVE-2025-24989 affects Microsoft Power Pages. An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update addressed the registration control bypass. Affected customers have been given instructions on reviewing their sites for potential exploitation and clean up methods. If you've not been notified this vulnerability does not affect you.
How severe is CVE-2025-24989?
CVE-2025-24989 is rated HIGH with a CVSS base score of 8.2. EPSS puts the probability of exploitation in the next 30 days at 1.6%, higher than 75.4% of all scored vulnerabilities. It is listed in the CISA Known Exploited Vulnerabilities catalog, with a federal remediation deadline of 14 March 2025.
How should organisations respond to CVE-2025-24989?
Apply the vendor patch for Microsoft Power Pages as the first priority, and treat any internet-facing instance as the most urgent. Because this vulnerability is associated with ransomware activity, also review whether the affected systems were reachable before patching, rather than assuming that patching alone closes the incident.