---
title: "Microsoft Partner Center CVE-2024-49035: Exploited EoP"
url: https://erroneo.us/security/briefs/microsoft-partner-center-cve-2024-49035-privilege-escalation/
description: "Exploited privilege escalation in partner.microsoft.com, fixed by Microsoft in Nov 2024; nothing to patch. Most can relax; CSP partners should review access."
type: security-brief
section: "Security Digest"
date_published: 2024-11-26
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Most can relax"
cves: ["CVE-2024-49035"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Microsoft Partner Center CVE-2024-49035: Exploited EoP

**Verdict: Most can relax.** There is nothing to patch: Microsoft fixed this in its own service in November 2024, so only Microsoft partners, and customers who give partners admin rights, have a reason for a one-time access review.

- **Who must act:** Microsoft partner organizations that sign in to Partner Center, especially Cloud Solution Provider resellers and managed service providers that hold admin roles in customer tenants.
- **Who can relax:** Everyone who never uses Partner Center; there is no software, build or setting to change on your side.
- **Affected:** Microsoft Partner Center (partner.microsoft.com), a Microsoft-hosted service, before Microsoft's November 2024 fix
- **Fixed:** Fixed by Microsoft in the service; advisory published Nov 26, 2024 with Customer Action Required: No
- **CVEs:** CVE-2024-49035
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check whether anyone in your organization signs in to Partner Center; if nobody does, close the item.
2. Partners: review Partner Center users and roles, remove stale or unknown accounts, and require MFA for every partner user.
3. Partners: export the Partner Center activity log and keep copies, because older entries are deleted automatically.
4. CSP customers: review Settings > Partner relationships in the Microsoft 365 admin center and remove partner admin roles you no longer need.
5. Record for auditors that the fix was applied by Microsoft in the service and needs no customer patch.

### How to check if you are affected

- Partners: look in the Partner Center activity log for actions by unfamiliar partner users, on unfamiliar customers, or orders and changes nobody requested.
- CSP customers: review Entra ID audit and sign-in logs for partner admin activity that does not match work you asked for.
- Expect gaps: the activity log keeps at most 800 records per subscription, so entries from late 2024 may be gone.

## What happened

On November 26, 2024, Microsoft published [CVE-2024-49035](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49035), an improper access control flaw in partner.microsoft.com. That is Partner Center, the portal Microsoft partners use to manage customer accounts, subscriptions and delegated administration. According to the advisory, the flaw lets an unauthenticated attacker elevate privileges over a network. Microsoft rated it Critical. The next day it corrected the advisory's "Exploited" flag to Yes. Microsoft credits Apoorv Wadhwa, Gautam Peri and an anonymous researcher. It has not said how the bug was used, against whom, or what attackers gained.

CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-49035) on February 25, 2025, three months after disclosure, with a March 18 deadline. CISA has not said what exploitation prompted the listing. [The Hacker News](https://thehackernews.com/2025/02/cisa-adds-microsoft-and-zimbra-flaws-to.html) noted that Microsoft "did not reveal any additional details on how it was weaponized."

The scores disagree. Microsoft gives CVSS 3.1 8.7, with a vector that assumes low privileges and user interaction. That vector does not match its own "unauthenticated" description. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-49035) scores it 9.8, assuming no privileges and no interaction.

## Who is affected

Only Microsoft's service was affected. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2024-49035) lists Microsoft Partner Center with no version, and the advisory marks "Customer Action Required: No". The CVE exists because of a June 2024 MSRC policy. Microsoft's [announcement](https://www.microsoft.com/en-us/msrc/blog/2024/06/toward-greater-transparency-unveiling-cloud-service-cves) says it will "issue CVEs for critical cloud service vulnerabilities, regardless of whether customers need to install a patch." One oddity: the FAQ explaining why no action is needed refers to "the Microsoft Power Apps online version" rather than Partner Center. Either way, the fix was rolled out on Microsoft's side.

## Do you really need to act?

For nearly everyone, no. There is no patch, version or setting to change. The only open question is whether anything an attacker did with elevated Partner Center access before the fix has outlived the fix. Two groups have something worth checking:

- **Microsoft partners**, especially CSP resellers and managed service providers. Partner Center is where they manage customers and see what their delegated administrators did.
- **Customers of CSP partners**, who should know which partners hold admin roles in their tenant. Microsoft already [recommends a quarterly review](https://learn.microsoft.com/en-us/microsoft-365/commerce/review-partner-admin-privileges) of those privileges.

Expect limited evidence. The [activity log](https://learn.microsoft.com/en-us/partner-center/activity-logs) keeps up to 800 records per subscription and deletes the oldest.

## What to do now

1. Ask whether anyone in your organization signs in to `partner.microsoft.com`. If nobody does, close the item.
2. Partners: review Partner Center users and roles, remove leavers and accounts nobody recognizes, and require MFA for all of them.
3. Partners: export the activity log from `Settings > Account settings > Activity Log > Export log`, and keep regular copies.
4. CSP customers: in the Microsoft 365 admin center, open `Settings > Partner relationships` and check the Roles column. Use Remove roles for anything no longer needed, and ask the partner to drop purchasing rights you do not want them to have.
5. Note for auditors that Microsoft fixed this in the service and that no customer patch exists.

## How to tell if you were hit

Microsoft has published no indicators. Partners should scan the activity log for actions by partner users they do not recognize, on customers they do not recognize, and for orders or changes nobody requested. CSP customers should review Entra ID audit and sign-in logs for partner admin activity that does not match work they asked for. If something cannot be explained, remove the partner's roles and open a case with Microsoft support.

## Timeline

- Jun 27, 2024 — Microsoft says it will issue CVEs for critical cloud service flaws, even when customers have nothing to patch.
- Nov 26, 2024 — Microsoft publishes CVE-2024-49035.
- Nov 27, 2024 — Microsoft corrects the advisory's Exploited flag to Yes.
- Feb 25, 2025 — CISA adds the CVE to KEV.
- Mar 18, 2025 — CISA's remediation deadline for federal agencies.

## Sources

1. [Microsoft MSRC — CVE-2024-49035 Partner.Microsoft.Com Elevation of Privilege Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49035)
2. [Microsoft MSRC — November 2024 Security Updates (CVRF)](https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2024-Nov)
3. [CVE record — CVE-2024-49035](https://www.cve.org/CVERecord?id=CVE-2024-49035)
4. [NVD — CVE-2024-49035](https://nvd.nist.gov/vuln/detail/CVE-2024-49035)
5. [CISA — Known Exploited Vulnerabilities: CVE-2024-49035](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-49035)
6. [Microsoft MSRC — Toward greater transparency: Unveiling Cloud Service CVEs](https://www.microsoft.com/en-us/msrc/blog/2024/06/toward-greater-transparency-unveiling-cloud-service-cves)
7. [Microsoft Learn — Partner Center activity logs](https://learn.microsoft.com/en-us/partner-center/activity-logs)
8. [Microsoft Learn — Review cloud solution provider (partner) admin privileges](https://learn.microsoft.com/en-us/microsoft-365/commerce/review-partner-admin-privileges)
9. [The Hacker News — CISA Adds Microsoft and Zimbra Flaws to KEV Catalog Amid Active Exploitation](https://thehackernews.com/2025/02/cisa-adds-microsoft-and-zimbra-flaws-to.html)

---
Source page: https://erroneo.us/security/briefs/microsoft-partner-center-cve-2024-49035-privilege-escalation/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt