Read the docs
TI-2025-18667 Aliases CVE-2025-24989GHSA-pxjr-976r-24r6

Microsoft Power Pages Elevation of Privilege Vulnerability

Priority CRITICAL 100Exploited in the wildCWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from Microsoft.

Summary

An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update addressed the registration control bypass. Affected customers have been given instructions on reviewing their sites for potential exploitation and clean up methods. If you've not been notified this vulnerability does not affect you.

Why it matters now

Exploitation Active In CISA KEV since 2025-02-21CISA due date 2025-03-14
EPSS 0.01622 76th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft Power Pages-—No fix listedCNA
  • Microsoft Power Pages VendorMicrosoft Affected - Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:power_pages:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
  • cpe:2.3:a:microsoft:power_pages:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Elevation of Privilege
Exploited
Yes
Publicly disclosed
No
Exploitability
Exploitation Detected
ProductStatusPlan or fix
1AffectedNo update listed

Timeline

  1. 2025-02-21 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2025-24989
  3. 2026-10-03 Alias added: GHSA-pxjr-976r-24r6

References

Patch 1

  • TI-2026-19044 Microsoft Power Pages Remote Code Execution Vulnerability CVSS 3.1CRITICAL 10.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences