Microsoft Power Pages vulnerabilities

2 known vulnerabilities in Microsoft Power Pages from Microsoft. 2 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Microsoft Power Pages: Improper Neutralization of Special Elements used in a Command

  CVE-2026-23652May 22, 2026Microsoft

  Improper neutralization of special elements used in a command ('command injection') in Microsoft Power Pages allows an unauthorized attacker to execute code over a network.

• 9.8 Critical severity

  Microsoft Power Pages Improper Access Control Exploited

  CVE-2025-24989Feb 19, 2025MicrosoftEPSS 1.62%

  An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected cust