Is CVE-2025-24989 (Microsoft Power Pages Improper Access Control) being exploited in the wild?

Yes. CISA added CVE-2025-24989 to its Known Exploited Vulnerabilities catalogue on 21 February 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft Power Pages contains an improper access control vulnerability that allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control.

What “exploited in the wild” means for this CVE

For this question, the practical answer is not just that a flaw exists, but that there is enough evidence of active abuse for defenders to treat it as a live incident response issue. CISA’s KEV listing is the key signal: once a vulnerability appears there, organisations should assume exploitation is credible and start from exposure reduction, not from a theoretical patch cycle.

The issue in CVE-2025-24989 is access control failure, so the first operational question is whether any public-facing Power Pages instance is reachable from the internet and whether registration, role assignment, or other user-facing flows could be influenced by an unauthorised party. That is the kind of boundary failure that turns a web bug into privilege escalation.

If you are validating exposure, check not only whether the product is deployed, but whether the affected site patterns, custom authentication flow, or delegated admin setup create an abuse path. For confirmed exposure, the response should be treated as a combination of patching, control verification, and compromise assessment, not as a routine maintenance change.

How to respond when exploitation is already underway

When a vulnerability is already being exploited, the response priority shifts from “can we patch soon?” to “can we still trust the current instance?” That means confirming the vendor fix or mitigation in the advisory, then verifying whether the application has been accessed or modified in ways that indicate privilege escalation, account creation abuse, or tampering with registration controls.

Because the flaw can enable unauthorised privilege gain, review any accounts, roles, or administrative actions that should not exist under normal registration rules. If the site exposes business data, workflow data, or admin functions, assume an attacker may have explored those paths before the vulnerability was remediated.

If patching must wait, isolate the exposed service as much as possible, reduce reachable attack surface, and increase logging around authentication, registration, and admin-change events. The goal is to make exploitation harder and easier to detect, even before the underlying product issue is fully fixed.

For a broader playbook on how to prioritise actively exploited flaws, CISA’s Known Exploited Vulnerabilities Catalog is the authoritative starting point, and NHIMG’s Zero-Day and Exploited Vulnerabilities Guide covers the KEV-driven triage logic practitioners use in practice.

What to check after remediation

Once the fix is applied, do not stop at “patched successfully.” Validate whether the site was exposed long enough for reconnaissance, privilege escalation, or account manipulation. Review authentication and registration events, privilege changes, content or configuration edits, and any unusual requests against the Power Pages instance during the exposure window.

Also verify that the business process itself still behaves correctly after remediation. Access control bugs often hide in the gap between product behaviour and local configuration, so you want to confirm that the intended registration, approval, and administrative boundaries are restored, not just that a patch was installed.

Where the site supports sensitive workflows, consider whether session invalidation, password resets, or role review are warranted for accounts that may have been touched during the window. The exact response depends on what the instance exposed, but the principle is simple: if an attacker may have gained elevated access, trust should be re-earned.

For teams managing repeated exposure risk, NHIMG’s Vulnerability Management Guide is useful for turning exploitation signals into a repeatable remediation and verification process, and the NIST National Vulnerability Database remains useful for record-level tracking and supplier reference.

Risk and Threat Considerations

Actively exploited access-control flaws are high-concern because the attacker does not need to break encryption or brute-force credentials. If the control boundary is weak, the attacker can move straight to privilege gain, data access, or administrative abuse while looking like a normal user flow.

Failure mechanism: The application accepts a request or role transition that should have been denied, allowing an unauthorised actor to cross the intended access boundary and elevate privileges.

Impact: Depending on what the site exposes, that can lead to unauthorised data access, account compromise, tampering with business content or workflows, and persistence through newly created or modified access paths.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	DE.CM-01 — Continuous Monitoring	Active exploitation needs ongoing monitoring for abnormal access and privilege events.
Recommendation — Monitor authentication and privilege-change activity for signs of abuse.
NIST SP 800-53 Rev 5	AC-6 — Least Privilege	The flaw is an access-control failure that can enable privilege escalation.
	AU-6 — Audit Review, Analysis, and Reporting	Post-exploitation checks depend on reviewing logs for suspicious access and changes.
Recommendation — Restrict privileges so a single boundary failure cannot expose elevated access. Review audit records for unexpected registration, role, and admin actions.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed exploitation requires rapid identification, prioritization, and remediation.
Recommendation — Prioritise and remediate exploited vulnerabilities using exposure-driven workflows.
OWASP ASVS	V8 — Authorization	Improper access control maps directly to authorization checks and privilege boundaries.
Recommendation — Verify server-side authorization on every role and access decision.

Practitioner Guidance

What to verify: Confirm whether any public Power Pages site was exposed before remediation, whether registration or role-assignment flows were reachable, and whether logs show unexpected privilege or configuration changes during the exposure window.

Decision rule: If the instance was internet-facing and you cannot confidently rule out abuse, treat the event as a potential compromise investigation, not only a patching task. If the service is business-critical, contain first, then validate normal operation after the fix.

Practitioner takeaway: With a KEV-listed access-control flaw, the key question is not whether exploitation is possible, but whether you can still trust the instance after exposure. Patch quickly, then prove the application was not used to cross privilege boundaries.