CVE-2025-65041

The vulnerability results from improper authorization (CWE-285), meaning the system does not properly verify whether the requesting party has the right to perform a specific operation. An attacker can send a crafted network request to Microsoft Partner Center without providing any credentials and gain access to resources or functions restricted to privileged users. The attack vector is network-based, requires no complexity and no prior access to the victim's environment.

An attacker can obtain elevated privileges in the Microsoft Partner Center service, which with a CVSS scope indicating impact beyond the original component (S:C) can lead to full compromise of confidentiality, integrity, and availability of associated resources.

Apply patches available from the vendor according to references: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-65041. As a Microsoft cloud service, the patch may be deployed on the vendor side — it is recommended to verify the update status in Microsoft Security Response Center.

Microsoft Partner Center — versions indicated in vendor references