Skip to content
COOEY

FAIL › dossier

Power Pages

PRODUCT

· dossier confidence 40%

Microsoft Power Pages is a low-code portal-building platform from Microsoft that has demonstrated a poor security track record, with high and critical vulnerabilities actively exploited in the wild. Its security posture is characterized by repeated improper access controls and command injection flaws, making it a high-risk component for defense-industrial-base and CMMC compliance.

Failure events
2
Zero-days
0
RCEs
0
On KEV
1
Critical
1
Worst shame
50
PROFILE
CategorySoftwareWhat they doMicrosoft Power Pages is a low-code platform within the Microsoft Power Platform that enables organizations to build secure, data-driven websites and portals for external users.Founded2021 Websitehttps://powerpages.microsoft.com ↗
SECURITY POSTURE

Microsoft Power Pages has a poor security track record, with high and critical vulnerabilities actively exploited in the wild, including improper access controls and command injection flaws.

Notable failures
  • CVE-2025-24989: Improper access control allowing privilege escalation and bypassing user registration controls
  • CVE-2026-23652: Command injection vulnerability
Patterns: repeated improper access control and command injection vulnerabilities
FAILURE HISTORY · 2
DATEEVENTSEVSUMMARY
2025-02-21 CVE-2025-24989 high Microsoft Power Pages has an improper access control vulnerability actively exploited in the wild, allowing privilege escalation and bypassing user registration controls.
2026-05-22 CVE-2026-23652 critical CVE-2026-23652: Improper neutralization of special elements used in a command ('command injectio
DOSSIER SOURCES
Open questions: Exact founding date and headquarters location of the Power Pages product line · Specific size metrics (employee count) for the Power Pages development team
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-09-18 04:27:42.290905+00:00