Exploitation ongoing with high activity in latest observed window (2 mentions)
Recommended action window: Immediate (within 24h)
NVD description
An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2025-03-18. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
[HIGH] CISA Adds Microsoft and Zimbra Flaws to KEV Catalog Amid Active Exploitation CISA added CVE-2024-49035 to KEV Catalog due to active exploitation. CVE: CVE-2024-49035 • APT: N/A • Status:… https://xage.com/blog/cyber-attack-news-risk-roundup-top-stories-for-february-2026/
Post summary
CISA has added CVE-2024-49035 to its KEV catalog citing active exploitation in the wild.
[HIGH] CISA Adds Microsoft and Zimbra Flaws to KEV Catalog CISA adds Microsoft and Zimbra vulnerabilities to KEV; remediation required. CVE: CVE-2024-49035 • APT: N/A • Stat… https://www.cyberscotland.com/wp-content/uploads/2025/02/SC3-Daily-threat-bulletin-26-February-2025.pdf
Post summary
CISA has added CVE-2024-49035 to its KEV catalog, indicating that the vulnerability is actively exploited and requires remediation, though specific patch details are not provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | microsoft | partner_center | - | - | - |