Back to CVE Browser

CVE-2025-24989

🔥 Known Exploited (CISA KEV)HIGH

8.2

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2025-02-19

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update addressed the registration control bypass. Affected customers have been given instructions on reviewing their sites for potential exploitation and clean up methods. If you've not been notified this vulnerability does not affect you.

Affected Platforms (CPE)

📦

Microsoft

Power Pages

All versions

References & Advisories

🔗 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24989

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24989

Related Security Intelligence Articles

Weekly Cybersecurity News: Jul 27, 2026

Weekly cybersecurity news covering active exploitation of Check Point SmartConsole CVE-2026-16232, Qilin ransomware leveraging PAN-OS GlobalProtect vulnerabilities, Russian LAUNDRY BEAR targeting Zimbra email servers, and FakeGit malicious repositories.

Global Cyber Intel Digest: July 24, 2026

This digest covers active exploitation of Check Point CVE-2026-16232 SmartConsole authentication bypass, Russian LAUNDRY BEAR targeting Zimbra vulnerabilities, malicious Claude Desktop ad campaigns deploying SectopRAT, and Chaos ransomware msaRAT operations.

Global Cyber Intel Digest: July 23, 2026

Key threat updates including CISA's KEV addition of Langflow CVE-2026-0770 remote code execution, unauthenticated path traversal in Windmill CVE-2026-29059, and ongoing incident response guidance for SonicWall SMA1000 zero-day exposures.

Related Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcns_follow in log_replay conversion log_...

The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HT...

The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plu...

The Advanced Ads WordPress plugin before 2.0.23 does not sanitize and escape a shortcode parameter before outputting it in the pa...