Loading vulnerability…
Microsoft Dataverse Elevation of Privilege Vulnerability
CVE-2025-24053 is a high-severity improper authorization vulnerability in the Microsoft Dataverse hosted service. An authorized attacker can exploit the flaw remotely over the network to elevate privileges. Microsoft assigned a CVSS v3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables privilege escalation and may result in high-impact compromise of confidentiality, integrity, and availability within the affected Dataverse environment.
If you can’t patch tonight, do this now.
No separate customer mitigation is specified because Microsoft remediated the issue automatically. Organizations should maintain least-privilege access controls for Dataverse users and regularly review privileged roles and permissions.
Patch, then assume compromise.
Microsoft automatically remediated CVE-2025-24053 in the hosted Microsoft Dataverse service. No customer-applied update or additional system update is required for this vulnerability.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.