Everything you need to know about the Microsoft Power Pages vulnerability
Microsoft has fixed an escalation of privileges flaw in its SaaS web development platform
A severe Microsoft Power Pages vulnerability has been fixed after cyber criminals were found to have been exploiting unpatched systems in the wild.
The company noted that it has remedied the high severity flaw associated with how the SaaS platform handles access permissions and potentially leaving a backdoor for malicious actors.
CVE-2025-24989 is described as an improper access vulnerability in the National Vulnerability Database designated as high severity with a score of 8.2 in the CVSS.
It could potentially allow an unauthorized attacker to elevate privileges over a network, bypass the platform’s user registration controls, and access restricted information or modify sensitive files.
Microsoft said the vulnerability has already been mitigated and all affected customers have been notified with instructions on how to assess if their sites are open to potential exploitation.
The security bulletin notes that it has detected threat actors exploiting the flaw in the wild but did not provide any further information.
Ben McCarthy, lead cyber security engineer at Immersive, outlined how these flaws arise in platforms like Power Pages.
“These vulnerabilities occur in SaaS platforms when attackers can find pathways through the platform's logic that have not been fully tested by the SaaS platform owners,” he said “Often done by chaining APIs together or using the platform functionality in an unexpected order, attackers can bypass certain protections put in place if users follow the usual steps taken on the platform.”
How to address the Power Pages vulnerability
McCarthy noted that Microsoft was fairly quick to address the issue before potentially wider exploitation was possible.
“However, having the level of monitoring that Microsoft can supply these platforms created through Power Pages, they quickly found the vulnerability and have mitigated it," he added.
"This means this vulnerability is no longer present in Power Pages websites, and for the organisations and individuals that have been affected by the vulnerability, Microsoft has notified and worked with them to properly contain and deal with the intrusion.”
RELATED WHITEPAPER
Businesses that have not been notified are not affected by the vulnerability, Microsoft stated, but those who have should make a number of precautionary checks to ensure they are safe.
This includes reviewing your user access logs to establish if there has been any unauthorized access that Microsoft may have missed, as well as ensuring your Power Pages environment is protected with multi-factor authentication and monitoring through the Power Pages Admin Center.
MORE FROM ITPRO
- Flaws in a popular dev library could let hackers run malicious code in your MongoDB database
- A critical Ivanti flaw is being exploited in the wild – here’s what you need to know
- Warning issued after SharePoint flaw puts entire corporate networks at risk
-
Why your best engineers are doing the wrong workIndustry Insights Why MSPs should adopt platform engineering to free engineers for more strategic work.
-
How Tim Cook turned Apple into a 'durable' tech industry powerhouseNews Tim Cook might not boast the same tech visionary status as Steve Jobs, but the company’s growth has been remarkable
-
Brace yourselves for a vulnerability explosion, Forescout warnsNews AI advances are helping identify software flaws at record pace and scale, but that's not the good news some would think
-
Ubuntu vulnerability exposes enterprises to root escalation, complete system compromiseNews The high-severity Ubuntu vulnerability allows an unprivileged local attacker to escalate privileges through the interaction of two standard system components
-
Is your new hire an AI clone? Microsoft says North Korean hackers are using AI to impersonate job seekers and steal company secretsNews The groups are increasingly using face-changing or voice-changing software to make their fake identities more plausible
-
Security agencies issue warning over critical Cisco Catalyst SD-WAN vulnerabilityNews Threat actors have been exploiting the vulnerability to achieve root access since 2023
-
Millions of developers could be impacted by flaws in Visual Studio Code extensions – here's what you need to know and how to protect yourselfNews The VS Code vulnerabilities highlight broader IDE security risks, said OX Security
-
CVEs are set to top 50,000 this year, marking a record high – here’s how CISOs and security teams can prepare for a looming onslaughtNews While the CVE figures might be daunting, they won't all be relevant to your organization
-
Microsoft patches six zero-days targeting Windows, Word, and more – here’s what you need to knowNews Patch Tuesday update targets large number of vulnerabilities already being used by attackers
-
Thousands of Microsoft Teams users are being targeted in a new phishing campaignNews Microsoft Teams users should be on the alert, according to researchers at Check Point
