{"id":"CVE-2024-49035","published":"2024-11-26T20:15:31Z","modified":"2026-06-17T07:59:16Z","title":"Microsoft Partner Center Improper Access Control Vulnerability","vendor":"Microsoft","product":"Partner Center","tier":"core","eol":null,"description":{"text":"An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network.","provenance":"source","from":"NVD"},"summary":{"text":"Microsoft Partner Center contains an improper access control vulnerability in the Partner.Microsoft.com component that allows privilege escalation. An unauthenticated attacker with network access can exploit it without any user interaction to elevate their privileges.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:14:35Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.013,"percentile":0.70375,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-02-25","dueDate":"2025-03-18","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49035 ; https://nvd.nist.gov/vuln/detail/CVE-2024-49035","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-11-26","exploitedFirstSeen":"2024-11-26","ransomware":false,"evidence":[{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2024-Nov","date":"2024-11-26"},{"url":"https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-49035","date":"2024-11-27"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-02-25"},{"url":"https://cyble.com/resources/research-reports/global-cybersecurity-report/","date":"2025-12-11"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"}],"evidenceTotal":5,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-269","name":"Improper Privilege Management"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49035","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-49035","tags":["US Government Resource"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Improper Access Control","mappingType":"exploitation_technique","evidence":[],"comment":"The details of this exploit are not publicly disclosed, but due to improper access controls in the Microsoft Power Apps backend, attackers can potentially escalate their privileges, affecting the Partner Center web portal and putting the data stored there at risk.","confidence":"high"},{"id":"T1195","name":"Supply Chain Compromise","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Improper Access Control","mappingType":"primary_impact","evidence":[],"comment":"The details of this exploit are not publicly disclosed, but due to improper access controls in the Microsoft Power Apps backend, attackers can potentially escalate their privileges, affecting the Partner Center web portal and putting the data stored there at risk.","confidence":"high"},{"id":"T1530","name":"Data from Cloud Storage","tactics":["collection"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Improper Access Control","mappingType":"primary_impact","evidence":[],"comment":"The details of this exploit are not publicly disclosed, but due to improper access controls in the Microsoft Power Apps backend, attackers can potentially escalate their privileges, affecting the Partner Center web portal and putting the data stored there at risk.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-43908","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-43908","exploited":true,"exploitedSince":"2025-02-25","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"source"},{"stage":"primary","techniques":["T1195","T1530"],"provenance":"source"}],"timeline":[{"date":"2024-11-26","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49035","provenance":"source"},{"date":"2024-11-26","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2024-Nov","provenance":"source"},{"date":"2025-02-25","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-02-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-43908","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":91},"priority":{"score":58.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 703 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":14.07,"detail":"percentile 0.7037"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}