A severe Microsoft Power Pages vulnerability has been fixed after cyber criminals were found to have been exploiting unpatched systems in the wild.
The company noted that it has remedied the high severity flaw associated with how the SaaS platform handles access permissions and potentially leaving a backdoor for malicious actors.
CVE-2025-24989 is described as an improper access vulnerability in the National Vulnerability Database designated as high severity with a score of 8.2 in the CVSS.
It could potentially allow an unauthorized attacker to elevate privileges over a network, bypass the platform’s user registration controls, and access restricted information or modify sensitive files.
Microsoft said the vulnerability has already been mitigated and all affected customers have been notified with instructions on how to assess if their sites are open to potential exploitation.
The security bulletin notes that it has detected threat actors exploiting the flaw in the wild but did not provide any further information.
Ben McCarthy, lead cyber security engineer at Immersive, outlined how these flaws arise in platforms like Power Pages.
“These vulnerabilities occur in SaaS platforms when attackers can find pathways through the platform’s logic that have not been fully tested by the SaaS platform owners,” he said “Often done by chaining APIs together or using the platform functionality in an unexpected order, attackers can bypass certain protections put in place if users follow the usual steps taken on the platform.”
How to address the Power Pages vulnerability
McCarthy noted that Microsoft was fairly quick to address the issue before potentially wider exploitation was possible.
“However, having the level of monitoring that Microsoft can supply these platforms created through Power Pages, they quickly found the vulnerability and have mitigated it,” he added.
“This means this vulnerability is no longer present in Power Pages websites, and for the organisations and individuals that have been affected by the vulnerability, Microsoft has notified and worked with them to properly contain and deal with the intrusion.”
Businesses that have not been notified are not affected by the vulnerability, Microsoft stated, but those who have should make a number of precautionary checks to ensure they are safe.
This includes reviewing your user access logs to establish if there has been any unauthorized access that Microsoft may have missed, as well as ensuring your Power Pages environment is protected with multi-factor authentication and monitoring through the Power Pages Admin Center.
