CVE-2024-49035
Published: 26 November 2024
Summary
CVE-2024-49035 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Microsoft Partner Center. Its CVSS base score is 8.7 (High).
Operationally, ranked in the top 9.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2024-49035 is an improper access control vulnerability, tracked under CWE-269, that affects the Partner.Microsoft.com service. The flaw permits an attacker to bypass intended authorization checks and elevate privileges when interacting with the component over a network. It received a CVSS 3.1 base score of 8.7 reflecting network attack vector, low attack complexity, and high impact on confidentiality and integrity.
An unauthenticated attacker can exploit the issue remotely to gain elevated privileges on the affected Microsoft partner platform, potentially allowing unauthorized access to sensitive resources or administrative functions without requiring user interaction beyond the initial request.
Microsoft has published remediation guidance in its Security Response Center advisory for CVE-2024-49035, while CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, confirming observed real-world exploitation activity. The associated EPSS score has remained essentially flat, moving only from a peak of 0.0632 to a current value of 0.0616.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-43908
Vulnerability details
An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network.
- CWE(s)
- KEV Date Added
- 25 February 2025
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces approved access control policies to block the unauthorized privilege elevation path exploited by the unauthenticated network attacker.
Limits privileges assigned to accounts and processes, reducing the impact and feasibility of the improper privilege management flaw (CWE-269).
Governs creation, modification, and privilege assignment for accounts, directly addressing the root cause of excessive or misconfigured access rights in the partner portal.