CVE-2025-24989
Microsoft Power Pages Elevation of Privilege Vulnerability
Reported by microsoft · Published February 19, 2025
An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update addressed the registration control bypass. Affected customers have been given instructions on reviewing their sites for potential exploitation and clean up methods. If you've not been notified this vulnerability does not affect you.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Microsoft Power Pages | - |
| microsoft | power_pages | * |
| Microsoft | Microsoft Power Pages | * |
Timeline
- Feb 11, 2025 CVE Published
- Feb 19, 2025 VulnCheck KEV Exploitation (5 in total, the first dated here)
- Feb 19, 2025 PoC Published (40 in total, the first dated here)
- Feb 20, 2025 EPSS Score (30 in total, the first dated here)
- Feb 20, 2025 Coalition ESS Score (14 in total, the first dated here)
- Feb 21, 2025 CISA KEV Added
- Feb 21, 2025 CVE Updated
- Mar 2, 2026 Security Advisory (4 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-24989
vulnetix vdb fixes CVE-2025-24989Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-24989/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart