The vulnerability is an improper authorization flaw in Microsoft Partner Center that lets an attacker who is not authenticated gain higher privileges than are intended. By abusing this flaw, an attacker can access sensitive partner data, modify configuration settings, or perform other privileged actions. The weakness is categorized as CWE-285.

All Microsoft Partner Center deployments that have not applied the patch for CVE-2025-65041 remain vulnerable. This includes every version of the service sold by Microsoft, as no specific version list is provided.

The CVSS score of 10 reflects severe potential impact. The EPSS score of less than 1% indicates that, while the flaw is high severity, the likelihood of exploitation in the wild is currently very low. The likely attack vector is via network access to the Partner Center service, inferred from the description that the privilege escalation can be performed over a network. If exploited, an attacker would gain elevated privileges that could compromise confidentiality, integrity, and availability of partner data.