CVE-2026-40371

Microsoft Dynamics 365 (on-premises) Elevation of Privilege Vulnerability

Improper handling of insufficient permissions or privileges in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Dynamics 365 Dynamics 365 Server

CVE-2026-40417

Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability

Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Dynamics 365 Business Central Dynamics 365 Business Central 2024 Dynamics 365 Business Central 2024 Wave 1 and 5 more

CVE-2026-42833

Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Dynamics 365

CVE-2026-33821

Microsoft Dynamics 365 Customer Insights Elevation of Privilege Vulnerability

Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Dynamics 365 Dynamics 365 Customer Insights

CVE-2026-42898

Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.

CVSS 3.1 · 9.9 Critical EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

Dynamics 365

CVE-2026-32210

Microsoft Dynamics 365 (online) Spoofing Vulnerability

Server-side request forgery (ssrf) in Microsoft Dynamics 365 (Online) allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Dynamics 365 Dynamics 365 Online

CVE-2026-33103

Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability

Improper access control in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Dynamics 365

CVE-2025-58112

Microsoft Dynamics 365 Customer Engagement on‑premises Remote SQL Injection via Malicious RDL File

Microsoft Dynamics 365 Customer Engagement (on-premises) 1612 (9.0.2.3034) allows the generation of customized reports via raw SQL queries in an upload of a .rdl (Report Definition Language) file; this is then processed by the SQL Server Reporting Service. An account with the privilege Add Reporting Services Reports can upload a malicious rdl file. If the malicious rdl file is already loaded and it is executable by the user, the Add Reporting Services Reports privilege is not required. A malicious actor can trigger the generation of the report, causing the execution of arbitrary SQL commands in the underlying database. Depending on the permissions of the account running SQL Server Reporting Services, the attacker may be able to perform additional actions, such as accessing linked servers or executing operating system commands.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Dynamics 365 Customer Service

CVE-2025-30391

Microsoft Dynamics Information Disclosure Vulnerability

Improper input validation in Microsoft Dynamics allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 8.1 High EPSS 1.4% KEV · Not listed

Vendors

Microsoft

Products

Dynamics 365 Customer Service

CVE-2025-62210

Dynamics 365 Field Service (online) Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Dynamics 365

CVE-2025-62211

Dynamics 365 Field Service (online) Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Dynamics 365

CVE-2020-1591

Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability

A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected Dynamics server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected Dynamics server. The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current authenticated user. These attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions within Dynamics Server on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user. The security update addresses the vulnerability by helping to ensure that Dynamics Server properly sanitizes web requests.

CVSS 3.1 · 5.4 Medium EPSS 1.5% KEV · Not listed

Vendors

Microsoft

Products

Dynamics 365

CVE-2020-1182

Microsoft Dynamics 365 for Finance and Operations (on-premises) Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Microsoft Dynamics 365 for Finance and Operations (on-premises) version 10.0.11. An attacker who successfully exploited this vulnerability could gain remote code execution via server-side script execution on the victim server. An authenticated attacker with privileges to import and export data could exploit this vulnerability by sending a specially crafted file to a vulnerable Dynamics server. The security update addresses the vulnerability by correcting how Microsoft Dynamics 365 for Finance and Operations (on-premises) version 10.0.11 handles user input.

CVSS 3.1 · 7.3 High EPSS 2.8% KEV · Not listed

Vendors

Microsoft

Products

Dynamics 365 Dynamics 365 For Finance And Operations

CVE-2020-16978

Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability

<p>A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected Dynamics server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected Dynamics server.</p> <p>The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current authenticated user. These attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions within Dynamics Server on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user.</p> <p>The security update addresses the vulnerability by helping to ensure that Dynamics Server properly sanitizes web requests.</p>

CVSS 3.1 · 5.4 Medium EPSS 1.4% KEV · Not listed

Vendors

Microsoft

Products

Dynamics 365

CVE-2020-16956

Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability

<p>A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected Dynamics server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected Dynamics server.</p> <p>The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current authenticated user. These attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions within Dynamics Server on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user.</p> <p>The security update addresses the vulnerability by helping to ensure that Dynamics Server properly sanitizes web requests.</p>

CVSS 3.1 · 5.4 Medium EPSS 1.4% KEV · Not listed

Vendors

Microsoft

Products

Dynamics 365

CVE-2020-16943

Dynamics 365 Commerce Elevation of Privilege Vulnerability

<p>An elevation of privilege vulnerability exists in Microsoft Dynamics 365 Commerce. An unauthenticated attacker who successfully exploited this vulnerability could update data without proper authorization.</p> <p>To exploit the vulnerability, an attacker would need to send a specially crafted request to an affected server.</p> <p>The security update addresses the vulnerability by correcting how Microsoft Dynamics 365 Commerce performs authorization checks.</p>

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Microsoft

Products

Dynamics 365

CVE-2020-16878

Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability

<p>A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected Dynamics server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected Dynamics server.</p> <p>The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current authenticated user. These attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions within Dynamics Server on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user.</p> <p>The security update addresses the vulnerability by helping to ensure that Dynamics Server properly sanitizes web requests.</p>

CVSS 3.1 · 5.4 Medium EPSS 1.6% KEV · Not listed

Vendors

Microsoft

Products

Dynamics 365

CVE-2020-16872

Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability

<p>A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected Dynamics server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected Dynamics server.</p> <p>The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current authenticated user. These attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions within Dynamics Server on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user.</p> <p>The security update addresses the vulnerability by helping to ensure that Dynamics Server properly sanitizes web requests.</p>

CVSS 3.1 · 7.6 High EPSS 1.8% KEV · Not listed

Vendors

Microsoft

Products

Dynamics 365

CVE-2020-16871

Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability

<p>A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected Dynamics server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected Dynamics server.</p> <p>The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current authenticated user. These attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions within Dynamics Server on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user.</p> <p>The security update addresses the vulnerability by helping to ensure that Dynamics Server properly sanitizes web requests.</p>

CVSS 3.1 · 5.4 Medium EPSS 1.6% KEV · Not listed

Vendors

Microsoft

Products

Dynamics 365

CVE-2020-16864

Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability

<p>A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected Dynamics server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected Dynamics server.</p> <p>The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current authenticated user. These attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions within Dynamics Server on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user.</p> <p>The security update addresses the vulnerability by helping to ensure that Dynamics Server properly sanitizes web requests.</p>

CVSS 3.1 · 5.4 Medium EPSS 1.6% KEV · Not listed

Vendors

Microsoft

Products

Dynamics 365