CVE-2025-65041CWE-285

Microsoft Partner Center Elevation of Privilege Vulnerability

Critical · published December 18, 2025

CVSS v3.1
10.0
EPSS
1%
Percentile
55.0
In the wild
Unconfirmed
What it is

🚨 An attacker could boost their privileges over the network, potentially gaining control of the entire Microsoft Partner Center! 🔥 Think of this vulnerability like a hotel guest finding a way to access the staff-only areas, unlocking the secrets of management without a keycard. It's a breach of trust that could lead to chaos! If exploited, an unauthorized attacker could escalate their permissions, allowing them to access sensitive information or perform actions that should be reserved for trusted staff. This could result in data breaches, unauthorized transactions, or even a complete system takeover, putting your organization at severe risk!

Put simply

Think of this vulnerability like a hotel guest finding a way to access the staff-only areas, unlocking the secrets of management without a keycard. It's a breach of trust that could lead to chaos! This vulnerability stems from improper authorization checks within Microsoft Partner Center, enabling an attacker to gain elevated privileges and perform actions they shouldn’t be allowed to execute.

What to do

If exploited, an unauthorized attacker could escalate their permissions, allowing them to access sensitive information or perform actions that should be reserved for trusted staff. This could result in data breaches, unauthorized transactions, or even a complete system takeover, putting your organization at severe risk! Immediate action is crucial! Ensure that you apply the latest security updates from Microsoft to mitigate this vulnerability. Additionally, review user roles and permissions to ensure proper access controls are in place to prevent unauthorized privilege escalation. You've got this! With the right steps, you can shut down this vulnerability and keep your system secure! 🛡️

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:T/RC:C
CVSS v4.0
Not supplied
EPSS
0.00766 · 55.0th percentile
Weakness
CWE-285 · Improper Authorization
Published
2025-12-18T22:02Z
EPSS history
Timeline
  • 18 DEC 22:02Z
    Microsoft Partner Center Elevation of Privilege Vulnerability
    cvelistv5