Microsoft Power Pages vulnerabilities

CVE-2025-24989 [CRITICAL] CWE-284 CVE-2025-24989: An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate p An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update addressed the registration control bypass. Affected

CVE-2026-23652 [CRITICAL] CWE-77 CVE-2026-23652: Improper neutralization of special elements used in a command ('command injection') in Microsoft Pow Improper neutralization of special elements used in a command ('command injection') in Microsoft Power Pages allows an unauthorized attacker to execute code over a network.

CVE-2025-47733 [HIGH] CWE-918 CVE-2025-47733: Server-Side Request Forgery (SSRF) in Microsoft Power Apps allows an unauthorized attacker to disclo Server-Side Request Forgery (SSRF) in Microsoft Power Apps allows an unauthorized attacker to disclose information over a network