CVE-2026-47647: Microsoft Dynamics 365 Improper Access Control Privilege Escalation

Overview

CVE-2026-47647 is an improper access control weakness (CWE-284) in Microsoft Dynamics 365. According to the record, it allows an authorized attacker to elevate privileges over a network. The vulnerability was published on 2026-06-18 and is listed with status Analyzed. Details are in the Microsoft Security Response Center advisory.

Impact

Microsoft assigned a CVSS 3.1 base score of 9.9 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. In practical terms:

The attack is network-reachable and of low complexity.
Only low privileges are required, meaning a user with a valid but limited account could be the starting point.
No user interaction is needed.
Scope is changed, so impact may extend beyond the vulnerable component.
Confidentiality, integrity and availability impacts are all rated high.

A successful attacker could plausibly gain broader control over Dynamics 365 data and functions than their account should allow, which in business applications may expose customer, financial or operational records.

Affected products and versions

Microsoft Dynamics 365 — specific affected versions or deployment types are not specified in the record.

Consult the vendor advisory to determine whether your deployment (cloud or on-premises) is affected.

Exploitation status

The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no confirmed exploitation appears in the sources consulted. No EPSS score is available in the record.

Remediation and mitigation

Review the MSRC advisory for the fix or required customer action; the record lists no fixed version, which does not mean no fix exists.
If the affected service is cloud-hosted, confirm with Microsoft whether remediation is applied automatically or requires action.
For on-premises deployments, apply any updates Microsoft provides as a priority given the critical score.
Enforce least privilege: review user roles and security roles, remove unneeded accounts and restrict access for external or guest users.
Require strong authentication (such as MFA) for all Dynamics 365 accounts to reduce the risk of a low-privileged account being abused.

Detection guidance

Monitor Dynamics 365 and Microsoft 365 audit logs for unexpected role or permission changes.
Look for low-privileged accounts accessing records, entities or administrative functions outside their normal scope.
Alert on unusual bulk data access or exports from accounts with limited roles.
Correlate sign-in anomalies with subsequent privilege-related activity.

Limitations of the available information

The record does not specify affected versions, builds or whether online or on-premises editions are impacted.
No fixed version or patch identifier is listed.
The technical root cause beyond "improper access control" is not described.
No EPSS or SSVC data is available.

Frequently asked questions

What is CVE-2026-47647?

An improper access control vulnerability in Microsoft Dynamics 365 that allows an authorized attacker to elevate privileges over a network, rated CVSS 3.1 9.9 by Microsoft.

Is CVE-2026-47647 being exploited?

It is not in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Which versions are affected?

The record does not specify affected versions; check the Microsoft advisory for details on your deployment.

How do I fix it?

Follow the guidance in the MSRC advisory, apply any updates Microsoft provides, and reinforce least-privilege role assignments and strong authentication.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.