Microsoft Resolves Power Pages Zero-Day Flaw Exploited in Attacks: A Quick Look at What You Need to Know

Microsoft recently addressed a critical security flaw in its Power Pages platform. This vulnerability, identified as CVE-2025-24989, allowed unauthorized attackers to elevate their privileges and bypass user registration controls. The flaw posed a significant risk, as it could potentially grant attackers access to sensitive data and compromise connected systems.

Discovery and Impact

Raj Kumar, a Microsoft employee, discovered the vulnerability. It stemmed from improper access controls in the user registration system of Power Pages. This flaw earned a CVSS score of 8.2, indicating its high risk to organizations. The vulnerability’s exploitation was confirmed, highlighting the persistent security challenges in widely adopted cloud services.

Microsoft’s Response

Upon detection, Microsoft swiftly deployed fixes across its cloud infrastructure. The company notified affected customers and provided tailored guidance to audit site configurations for exploitation traces and remove unauthorized privilege assignments. Microsoft emphasized that only notified organizations required action, as mitigations were automatically applied to vulnerable instances.

Mitigation Steps

Microsoft advised administrators to review activity logs for suspicious actions, user registrations, or unauthorized changes. They should scrutinize user lists to verify administrators and high-privileged users. Recent changes in privileges, security roles, permissions, and web page access controls should be examined further. Rogue accounts or those showing unauthorized activity should be immediately revoked, affected credentials should be reset, and multi-factor authentication (MFA) should be enforced across all accounts.

Broader Implications

The discovery of this vulnerability coincides with heightened scrutiny of Power Pages’ security posture. In late 2024, misconfigured Power Pages implementations exposed over 7 million records across sectors like healthcare and finance. This incident underscores the importance of robust security measures in cloud-based services.

Conclusion

Microsoft’s prompt response to the Power Pages zero-day bug highlights the company’s commitment to security. By addressing the vulnerability and providing clear guidance to affected customers, Microsoft aims to mitigate the risks associated with this flaw. Organizations using Power Pages should remain vigilant and follow the recommended security practices to protect their systems and data.

You think you have a story worth everyone’s time? SUBMIT A STORY and we will publish it