Microsoft Dynamics 365 vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Microsoft Dynamics 365: 11 record(s), with affected versions and fixes.
cpe:2.3:a:microsoft:dynamics_365

CVE-2026-65772 High · 8.8 CWE-502 Sep 8, 2026

Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.

CVE-2026-47647 Critical · 9.9 CWE-284 Jun 18, 2026

Microsoft Dynamics 365 Improper Access Control Privilege Escalation (CVE-2026-47647)

Improper access control in Microsoft Dynamics 365 allows an authorized attacker to elevate privileges over a network.

CVE-2026-40371 High · 8.8 CWE-755 Jun 9, 2026

Microsoft Dynamics 365 (on-premises) Elevation of Privilege Vulnerability

Improper handling of insufficient permissions or privileges in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to elevate privileges over a network.

CVE-2026-42898 Critical · 9.9 CWE-94 May 12, 2026

Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.

CVE-2026-42833 Critical · 9.1 CWE-250 May 12, 2026

Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.

CVE-2026-33821 Critical · 9.9 CWE-269 May 12, 2026

Microsoft Dynamics 365 Customer Insights Elevation of Privilege Vulnerability

Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a network.

CVE-2026-32210 High · 7.5 CWE-918 Apr 23, 2026

Microsoft Dynamics 365 (online) Spoofing Vulnerability

Server-side request forgery (ssrf) in Microsoft Dynamics 365 (Online) allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-33103 Medium · 5.5 CWE-284 Apr 14, 2026

Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability

Improper access control in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information locally.

CVE-2025-62211 High · 8.7 CWE-79 Nov 11, 2025

Dynamics 365 Field Service (online) Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.

CVE-2025-62210 High · 8.7 CWE-79 Nov 11, 2025

Dynamics 365 Field Service (online) Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.

CVE-2025-62206 Medium · 6.5 CWE-200 Nov 11, 2025

Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclose information over a network.