All CVE records
CVE-2025-24989 — Microsoft Power Pages Improper Access Control Vulnerability
CISA KEV listed
Added February 21, 2025 Remediate by March 14, 2025
Description
Microsoft Power Pages contains an improper access control vulnerability that allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control.
Required action
Apply mitigations per vendor instructions, follow BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes
https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-24989 ; https://nvd.nist.gov/vuln/detail/CVE-2025-24989
Need help remediating this vulnerability?
Our team helps organizations patch, mitigate, and respond to CISA KEV advisories fast.