Hackers Exploit Microsoft Power Pages Flaw, Threatening Data Security

Attackers exploited a serious vulnerability in Microsoft’s Power Pages platform before it was fixed. The flaw, tracked as CVE-2025-24989, drew wide attention from security teams. As businesses rely more on web platforms to run their operations, it’s a reminder that cloud services need watching too.

What the Power Pages flaw allowed

Power Pages is part of Microsoft’s Power Platform and is widely used to build low-code business websites. Many organizations use it to publish portals quickly. That convenience became a liability when this flaw was found.

The vulnerability could let attackers get around site registration controls and gain higher privileges on a Power Pages site. That could expose data, and nobody might notice for months.

How the exploit worked

Microsoft classed the bug as improper access control, rated high severity. An unauthenticated attacker could use it over the network to escalate privileges. CISA added CVE-2025-24989 to its Known Exploited Vulnerabilities catalog on February 21, 2025. As CISA noted in adding it, this type of flaw is a frequent attack vector for malicious cyber actors.

Racing the attackers

Once a flaw like this is public, attackers move fast. Defenders have to move faster.

How Microsoft responded

Because Power Pages is a cloud service, Microsoft fixed the flaw on its side, with no patch for customers to install. It said it had notified the customers affected and given them guidance on reviewing their sites for signs of compromise and cleaning up. Customers who weren’t notified were not affected, according to Microsoft.

Microsoft encourages security researchers and customers to report vulnerabilities through its coordinated disclosure process, so flaws can be fixed before attackers find them.

What Power Pages customers should do

Organizations that use Power Pages should act now:

• Timely Updates: If Microsoft notified you, follow its guidance and review your sites right away.
• Enhanced Monitoring: Review site logs, user registrations and data activity for signs of unauthorized access.
• User Education: Teach employees to spot phishing and other tricks attackers use to get in.

The bigger lessons

The flaw also raises broader questions about how businesses secure the cloud and low-code tools they depend on:

Speed versus safety

Companies are adopting new platforms quickly. Security often lags. Teams that build on low-code tools need to know exactly who can register on their sites, what each role can see and which tables of customer or employee data sit one misconfigured permission away from the open internet.

People still matter

People remain a major weak point. Mistakes and oversights still give attackers a way in, which makes security training at every level of an organization essential.

Locking down low-code sites

The attacks on Power Pages show how quickly attackers move. Tighten security on the platforms you rely on.

Security teams, businesses and vendors need to share information and move faster on fixes.

Protecting data takes both good technology and alert people.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.