- Microsoft recently found and patched a high difficulty error on power pages
- The error made it possible for malicious actors to log on to target sites
- The vulnerability became firm but Microsoft warns potential victims to be on duty
Microsoft has corrected a high-sighted vulnerability in its Power Page product and has warned users to be looking for signs of exploitation.
The company recently published details of CVE-2025-24989, a wrong access control vulnerability on power pages that allow unauthorized attackers to raise privileges over a network, potentially bypassing user registration control. In other words, unauthorized attackers could use the vulnerability to log on to other people’s sites. It got a severity of 8.2/10 (high).
We do not know who is behind the attack or how many sites are affected. According to Microsoft, PAGER PAGS has more than 250 million active site users on a monthly basis including Britain’s national health care system.
Lapped Missing
Microsoft Power Pages is a low-code platform for building secure, data-driven sites that allow users to create and customize sites with drag-and-slip enclosure while integrating with other Microsoft services such as Power Automate and Dataverse .
It is designed for companies and organizations that need external portals for customers, partners or employees without demanding extensive coding expertise. It is a software-as-a-service (SaaS) that means that all patches and updates are performed by Microsoft on its servers.
The company already released the patch, but that doesn’t mean the problem is gone. Apparently, the cyber criminal discovered the error before Microsoft did, and used it to access at least a few sites. It is impossible to know what they did with access. They could redirect people to malicious sites, earn malvertising, stealing data and more.
The company warned some users to be careful and look for signs of exploitation.
“This vulnerability is already mitigated in the service and all affected customers have been notified,” Microsoft said. “Affected customers have been given instructions on reviewing their sites for potential exploitation and cleanup methods. If you have not been told, this vulnerability will not affect you. “
Via Registered
