CVE-2025-24989
CriticalExploitedPublic exploitMicrosoft Power Pages Elevation of Privilege Vulnerability
Published Feb 11, 2025 · Updated Feb 13, 2026
Key Facts
Patch immediately- CVE-2025-24989 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Power Pages (Microsoft).
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Feb 19, 2025. Public exploit code is available.
- EPSS estimates a 1.6% probability of exploitation in the next 30 days.
- No fixed version is listed yet; check the vendor advisory for mitigations.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
1.6%
Higher than 75.7% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2025-24989 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update addressed the registration control bypass. Affected customers have been given instructions on reviewing their sites for potential exploitation and clean up methods. If you've not been notified this vulnerability does not affect you.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | Feb 21, 2025 | Mar 14, 2025 | Not reported |
| Industry KEV feed | Feb 19, 2025 | Mar 14, 2025 | Not reported |
| CIRCL KEV | Feb 21, 2025 | Mar 14, 2025 | Not reported |
| ENISA EUVD | Feb 21, 2025 | n/a | Not reported |
Required action: Apply mitigations per vendor instructions, follow BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected Products
2 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Power PagesMicrosoft | See advisory | n/a |
Timeline
Publicly disclosed
Feb 11, 2025
Added to Industry KEV feed
Feb 19, 2025
Added to CISA KEV
Feb 21, 2025
Added to CIRCL KEV
Feb 21, 2025
Added to ENISA EUVD
Feb 21, 2025
Last updated
Feb 13, 2026
Weakness Type
- CWE-284 Improper Access Control
References
FAQ
Common Questions.
An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control.
Affected: Power Pages (Microsoft). The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Feb 19, 2025.
Yes. It was added on Feb 21, 2025 with a federal remediation due date of Mar 14, 2025.
Public exploit code is available.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2025-24989 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo