Microsoft Partner Center CVE-2024-49035: Exploited EoP

What to do

1. Check whether anyone in your organization signs in to Partner Center; if nobody does, close the item.
2. Partners: review Partner Center users and roles, remove stale or unknown accounts, and require MFA for every partner user.
3. Partners: export the Partner Center activity log and keep copies, because older entries are deleted automatically.
4. CSP customers: review Settings > Partner relationships in the Microsoft 365 admin center and remove partner admin roles you no longer need.
5. Record for auditors that the fix was applied by Microsoft in the service and needs no customer patch.

How to check if you are affected or compromised

• Partners: look in the Partner Center activity log for actions by unfamiliar partner users, on unfamiliar customers, or orders and changes nobody requested.
• CSP customers: review Entra ID audit and sign-in logs for partner admin activity that does not match work you asked for.
• Expect gaps: the activity log keeps at most 800 records per subscription, so entries from late 2024 may be gone.

What happened#

On November 26, 2024, Microsoft published CVE-2024-49035, an improper access control flaw in partner.microsoft.com. That is Partner Center, the portal Microsoft partners use to manage customer accounts, subscriptions and delegated administration. According to the advisory, the flaw lets an unauthenticated attacker elevate privileges over a network. Microsoft rated it Critical. The next day it corrected the advisory's "Exploited" flag to Yes. Microsoft credits Apoorv Wadhwa, Gautam Peri and an anonymous researcher. It has not said how the bug was used, against whom, or what attackers gained.

CISA added the CVE to the KEV catalog on February 25, 2025, three months after disclosure, with a March 18 deadline. CISA has not said what exploitation prompted the listing. The Hacker News noted that Microsoft "did not reveal any additional details on how it was weaponized."

The scores disagree. Microsoft gives CVSS 3.1 8.7, with a vector that assumes low privileges and user interaction. That vector does not match its own "unauthenticated" description. NVD scores it 9.8, assuming no privileges and no interaction.

Who is affected#

Only Microsoft's service was affected. The CVE record lists Microsoft Partner Center with no version, and the advisory marks "Customer Action Required: No". The CVE exists because of a June 2024 MSRC policy. Microsoft's announcement says it will "issue CVEs for critical cloud service vulnerabilities, regardless of whether customers need to install a patch." One oddity: the FAQ explaining why no action is needed refers to "the Microsoft Power Apps online version" rather than Partner Center. Either way, the fix was rolled out on Microsoft's side.

Do you really need to act?#

For nearly everyone, no. There is no patch, version or setting to change. The only open question is whether anything an attacker did with elevated Partner Center access before the fix has outlived the fix. Two groups have something worth checking:

• Microsoft partners, especially CSP resellers and managed service providers. Partner Center is where they manage customers and see what their delegated administrators did.
• Customers of CSP partners, who should know which partners hold admin roles in their tenant. Microsoft already recommends a quarterly review of those privileges.

Expect limited evidence. The activity log keeps up to 800 records per subscription and deletes the oldest.

What to do now#

1. Ask whether anyone in your organization signs in to partner.microsoft.com. If nobody does, close the item.
2. Partners: review Partner Center users and roles, remove leavers and accounts nobody recognizes, and require MFA for all of them.
3. Partners: export the activity log from Settings > Account settings > Activity Log > Export log, and keep regular copies.
4. CSP customers: in the Microsoft 365 admin center, open Settings > Partner relationships and check the Roles column. Use Remove roles for anything no longer needed, and ask the partner to drop purchasing rights you do not want them to have.
5. Note for auditors that Microsoft fixed this in the service and that no customer patch exists.

How to tell if you were hit#

Microsoft has published no indicators. Partners should scan the activity log for actions by partner users they do not recognize, on customers they do not recognize, and for orders or changes nobody requested. CSP customers should review Entra ID audit and sign-in logs for partner admin activity that does not match work they asked for. If something cannot be explained, remove the partner's roles and open a case with Microsoft support.

Timeline#

• Jun 27, 2024 — Microsoft says it will issue CVEs for critical cloud service flaws, even when customers have nothing to patch.
• Nov 26, 2024 — Microsoft publishes CVE-2024-49035.
• Nov 27, 2024 — Microsoft corrects the advisory's Exploited flag to Yes.
• Feb 25, 2025 — CISA adds the CVE to KEV.
• Mar 18, 2025 — CISA's remediation deadline for federal agencies.

Vulnerability records

• CVE-2024-49035 · KEV 2025-02-25 · An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft MSRC — CVE-2024-49035 Partner.Microsoft.Com Elevation of Privilege Vulnerability msrc.microsoft.com
2. Microsoft MSRC — November 2024 Security Updates (CVRF) api.msrc.microsoft.com
3. CVE record — CVE-2024-49035 cve.org
4. NVD — CVE-2024-49035 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2024-49035 cisa.gov
6. Microsoft MSRC — Toward greater transparency: Unveiling Cloud Service CVEs microsoft.com
7. Microsoft Learn — Partner Center activity logs learn.microsoft.com
8. Microsoft Learn — Review cloud solution provider (partner) admin privileges learn.microsoft.com

Coverage and analysis

1. The Hacker News — CISA Adds Microsoft and Zimbra Flaws to KEV Catalog Amid Active Exploitation thehackernews.com