# CVE-2024-49035: Microsoft Partner Center Improper Access Control Vulnerability

Source: https://junglewise.ai/threats/cve-2024-49035-microsoft-partner-center-improper-access-control-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-02-25. Updated: 2026-05-09  
License: CC BY 4.0 with a link back

CVE-2024-49035 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2025-02-25

Microsoft Partner Center (Partner.Microsoft.com) contains an improper access control vulnerability that allows an unauthenticated attacker to elevate privileges over a network. The flaw is tracked as CVE-2024-49035 and has been observed being exploited in the wild.

Technologies: [Microsoft Partner Center](https://junglewise.ai/threats/technologies/partner-center). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2024-49035 exploited in the wild?** Yes. CVE-2024-49035 is known to be exploited in the wild, first recorded on 25 February 2025. Treat it as urgent.

**How severe is CVE-2024-49035?** Critical severity, with a CVSS score of 9.8, published 25 February 2025.

**Which products and versions are affected?** Microsoft Partner Center Partner.Microsoft.com.

**Is there a fix for CVE-2024-49035?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2024-49035 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2024-49035?** Check whether you run Microsoft Partner Center. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Microsoft Partner Center Partner.Microsoft.com

## Timeline

- 2024-11-26: disclosed: NVD Published Date and initial receipt from Microsoft
- 2025-02-25: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
- 2025-02-25: exploited: Reported as exploited in the wild in advisory metadata

## Related threats

- [Microsoft Partner Center improper certificate validation](https://junglewise.ai/threats/cve-2026-96207-improper-certificate-validation-in-microsoft-partner-center)
- [Microsoft Partner Center authorization bypass via user-controlled key](https://junglewise.ai/threats/cve-2026-69558-microsoft-partner-center-authorization-bypass-via-user-controlled)
- [Externally controlled reference to a resource in another sphere in Microsoft Partner Center allows an unauthorized…](https://junglewise.ai/threats/cve-2026-34327-externally-controlled-reference-to-a-resource-in-another-sphere)
- [Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.](https://junglewise.ai/threats/cve-2026-24303-improper-certificate-validation-in-microsoft-partner-center)