CVE-2025-24989
Microsoft Power Pages Improper Access Control Vulnerability
Description
CVE-2025-24989 is a high-severity improper access control vulnerability in Microsoft Power Pages that allows an unauthorized attacker to elevate privileges over a network by bypassing user registration controls. Rated with a CVSS v3.1 base score of 8.2, this vulnerability requires no authentication and enables attackers to achieve high integrity impact against Power Pages deployments. CISA has added CVE-2025-24989 to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of March 14, 2025, confirming active exploitation. The EPSS score of 25.71% at the 96.1st percentile indicates a very high probability of exploitation, and Microsoft has confirmed that this vulnerability has already been mitigated in the service with all affected customers notified.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | power pages | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24989(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24989(US Government Resource)
Weakness Type
Improper Access Control — Registration Bypass
CVE-2025-24989 arises from an improper access control weakness in Microsoft Power Pages that specifically affects the user registration control mechanism. This class of vulnerability occurs when an application fails to adequately enforce access restrictions, allowing unauthorized actors to bypass intended security boundaries. In Power Pages, the registration control is designed to restrict who can create accounts and access the platform, but this vulnerability allows attackers to circumvent those controls entirely, potentially gaining elevated privileges without proper authorization.
Learn more: CWE-284 — Improper Access Control
Impact Analysis
CVE-2025-24989 poses a significant threat to organizations using Microsoft Power Pages for their web presence and business applications. The vulnerability is exploitable over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) and no user interaction (UI:N). Confidentiality (Low): While the direct confidentiality impact is rated low, an attacker bypassing registration controls could gain access to information intended only for registered or authorized users, including business data, user directories, and internal content published through Power Pages. Integrity (High): The primary risk is the high integrity impact — an attacker can bypass the user registration control to create unauthorized accounts with potentially elevated privileges, modify site content, alter business workflows, and manipulate data managed through Power Pages applications. This could undermine the trust and reliability of the organization's web-facing applications. Availability: No direct availability impact (A:N) is indicated in the CVSS vector, though unauthorized modifications could disrupt business operations indirectly. The EPSS score of 25.71% at the 96.1st percentile places this in the top 4% of vulnerabilities for exploitation likelihood. The ransomware status is listed as Unknown by CISA, but the privilege escalation capability could serve as an initial foothold for more extensive attacks.
Exploit Maturity
CVE-2025-24989 has confirmed exploit maturity with active exploitation in the wild. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 14, 2025, confirming that threat actors have successfully exploited this flaw. Microsoft has acknowledged the exploitation in their security advisory, stating that the vulnerability has already been mitigated in the service and all affected customers have been notified. The EPSS score of 25.71% at the 96.1st percentile indicates very high exploitation probability, placing it well above the vast majority of tracked vulnerabilities. The ransomware use status is listed as Unknown by CISA. Microsoft has released a patch addressing the registration control bypass and has provided affected customers with instructions for reviewing their environments for signs of compromise.
Remediation
-
Verify that the Microsoft service-side mitigation has been applied. Microsoft has stated that this vulnerability has been mitigated in the Power Pages service. Contact Microsoft support or check your Power Pages admin center to confirm that your environment has received the server-side fix addressing CVE-2025-24989.
-
Review user registration logs and audit trails. Examine all user accounts created in your Power Pages environment for unauthorized registrations. Look for accounts that bypassed normal registration workflows, have unexpected privilege levels, or were created during the window of vulnerability.
-
Revoke unauthorized accounts and reset compromised credentials. If any unauthorized or suspicious accounts are identified, immediately disable them and investigate any actions they performed. Reset credentials for any legitimate accounts that may have been affected by the privilege escalation.
-
Strengthen registration controls and access policies. Implement additional registration validation mechanisms such as email domain restrictions, approval workflows for new registrations, and CAPTCHA challenges. Review and tighten role-based access controls to ensure that newly registered users receive minimum necessary permissions.
-
Enable enhanced monitoring and alerting. Configure alerts for unusual registration activity, privilege escalation events, and administrative changes within your Power Pages environment. Integrate Power Pages logs with your SIEM solution for continuous monitoring of potential exploitation attempts.
Technical Details
CVE-2025-24989 is an improper access control vulnerability in Microsoft Power Pages, the low-code web development platform. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N reveals the following characteristics: Attack Vector (Network): The vulnerability is exploitable remotely through the Power Pages web interface, requiring no physical or local access. Attack Complexity (Low): Exploitation is straightforward and does not require specialized conditions or information. Privileges Required (None): This is a pre-authentication vulnerability — no existing account or credentials are needed to exploit it. User Interaction (None): The attack can be executed entirely by the attacker without any involvement from legitimate users. Scope (Unchanged): The vulnerability operates within the security context of the Power Pages platform. Confidentiality (Low): Limited information disclosure is possible through the registration bypass. Integrity (High): The primary impact is the ability to bypass user registration controls, create unauthorized accounts, and escalate privileges within the Power Pages environment. The underlying technical mechanism involves a flaw in the Power Pages user registration control system. The registration process fails to properly validate authorization during account creation, allowing an attacker to craft requests that bypass the intended access restrictions. This enables the creation of user accounts that should have been blocked by the registration control policies, and these accounts may receive elevated privileges that were not intended for externally registered users.
Frequently Asked Questions
Is CVE-2025-24989 being actively exploited?
Yes. CISA has confirmed active exploitation by including CVE-2025-24989 in the Known Exploited Vulnerabilities catalog. Microsoft has also acknowledged exploitation in their security advisory and has already deployed a service-side mitigation to address the vulnerability.
Has Microsoft already fixed CVE-2025-24989?
Yes. Microsoft has stated that the vulnerability has been mitigated in the Power Pages service and all affected customers have been notified. The update specifically addresses the registration control bypass. However, organizations should still review their environments for signs of prior exploitation.
What is the risk of CVE-2025-24989?
CVE-2025-24989 allows unauthenticated attackers to bypass Power Pages registration controls and potentially escalate privileges. The primary risk is unauthorized account creation with elevated permissions, which could lead to data manipulation, content modification, and unauthorized access to business applications hosted on Power Pages.
Do I need to take action for CVE-2025-24989?
Even though Microsoft has applied a server-side fix, affected organizations should audit their Power Pages user accounts for unauthorized registrations, revoke any suspicious accounts, and strengthen registration controls to prevent similar attacks in the future.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.