CVE-2024-49035

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published
Nov 26, 2024
Last modified
Jun 17, 2026
Added to CISA KEV
Feb 25, 2025
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-490389.6Improper neutralization of input during web page generation ('Cross-site Scripting') in Copilot Studio by an unauthorized attacker leads to CVE-2024-490398.8Windows Task Scheduler Elevation of Privilege VulnerabilityCVE-2024-49046.3A vulnerability was found in Byzoro Smart S200 Management Platform up to 20240507. It has been rated as critical. This issue affects some unCVE-2024-490407.5Microsoft Exchange Server Spoofing VulnerabilityCVE-2024-490414.3Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2024-490427.2Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege VulnerabilityCVE-2024-490437.8Microsoft.SqlServer.XEvent.Configuration.dll Remote Code Execution VulnerabilityCVE-2024-490446.7Visual Studio Elevation of Privilege VulnerabilityCVE-2024-490467.8Windows Win32 Kernel Subsystem Elevation of Privilege VulnerabilityCVE-2024-490488.1TorchGeo Remote Code Execution VulnerabilityCVE-2024-490497.1Visual Studio Code Remote Extension Elevation of Privilege VulnerabilityCVE-2024-49058.8A vulnerability classified as critical has been found in Kashipara College Management System 1.0. Affected is an unknown function of the fil