PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-49035 Microsoft CVE debrief

CVE-2024-49035 is an improper access control vulnerability in Microsoft Partner Center that CISA added to its Known Exploited Vulnerabilities catalog on 2025-02-25. Because it is on the KEV list, defenders should treat it as a priority exposure even though the supplied corpus does not include a CVSS score or deeper technical exploitation detail. CISA’s required action is to apply Microsoft mitigations, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Vendor
Microsoft
Product
Partner Center
CVSS
HIGH 8.7
CISA KEV
Listed
Original CVE published
2025-02-25
Original CVE updated
2025-02-25
Advisory published
2025-02-25
Advisory updated
2025-02-25

Who should care

Microsoft Partner Center administrators, cloud service and identity teams, managed service providers using Partner Center, and vulnerability/remediation owners responsible for CISA KEV response.

Technical summary

The available source data identifies the issue only as an improper access control vulnerability in Microsoft Partner Center. The corpus does not provide attack preconditions, affected components, or a CVSS rating. The key defensive signal is CISA KEV inclusion, which indicates known exploitation and elevates remediation urgency.

Defensive priority

High. Known-exploited vulnerabilities on the CISA KEV catalog should be prioritized for rapid mitigation within the stated deadline.

Recommended defensive actions

  • Review Microsoft’s official vulnerability guidance for CVE-2024-49035 and apply any vendor-provided mitigations or updates.
  • If mitigations are unavailable, follow CISA guidance for cloud services, including BOD 22-01 where applicable, or discontinue use of the product.
  • Validate whether your organization uses Microsoft Partner Center directly or through a provider and inventory all exposed tenants/accounts.
  • Track remediation against the CISA KEV due date of 2025-03-18.
  • Monitor for vendor and CISA updates related to this CVE.

Evidence notes

The supplied corpus contains CISA KEV metadata and official record links but no exploit narrative, affected-version list, or CVSS score. CISA lists the vulnerability as known exploited and cites Microsoft’s update guidance and the NVD detail page as supporting references.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-49035 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-49035

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-49035 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-49035

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.