Read the docs
TI-2020-12931 Aliases CVE-2020-16943GHSA-cwwh-8p3m-623m

Dynamics 365 Commerce Elevation of Privilege Vulnerability

Priority LOW 31Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

<p>An elevation of privilege vulnerability exists in Microsoft Dynamics 365 Commerce. An unauthenticated attacker who successfully exploited this vulnerability could update data without proper authorization.</p> <p>To exploit the vulnerability, an attacker would need to send a specially crafted request to an affected server.</p> <p>The security update addresses the vulnerability by correcting how Microsoft Dynamics 365 Commerce performs authorization checks.</p>

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01118 66th percentileScored 2026-11-07
Fix Fixed Dynamics 365 Commerce version 10.0.12 (Microsoft): publicationDynamics 365 Commerce version 10.0.13 (Microsoft): publication+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftDynamics 365 Commerce version 10.0.1210.0.0 to before publicationpublicationPatch availableCNA
MicrosoftDynamics 365 Commerce version 10.0.1310.0.0 to before publicationpublicationPatch availableCNA
MicrosoftDynamics 365 Commerce version 10.0.1410.0.0 to before publicationpublicationPatch availableCNA
MicrosoftDynamics 365 Commerce version 10.0.1510.0.0 to before publicationpublicationPatch availableCNA
MicrosoftDynamics 365 Commerce version 10.0.1610.0.0 to before publicationpublicationPatch availableCNA
  • Dynamics 365 Commerce version 10.0.12 VendorMicrosoft Affected 10.0.0 to before publication Fixed in publication Patch available CNA
  • Dynamics 365 Commerce version 10.0.13 VendorMicrosoft Affected 10.0.0 to before publication Fixed in publication Patch available CNA
  • Dynamics 365 Commerce version 10.0.14 VendorMicrosoft Affected 10.0.0 to before publication Fixed in publication Patch available CNA
  • Dynamics 365 Commerce version 10.0.15 VendorMicrosoft Affected 10.0.0 to before publication Fixed in publication Patch available CNA
  • Dynamics 365 Commerce version 10.0.16 VendorMicrosoft Affected 10.0.0 to before publication Fixed in publication Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:dynamics_365:-:*:*:*:commerce:*:*:*not specified by NVDVulnerableMicrosoft
  • cpe:2.3:a:microsoft:dynamics_365:-:*:*:*:commerce:*:*:* Versions not specified by NVD Vulnerable ·Microsoft

Remediation

  • Fix · CNA Dynamics 365 Commerce version 10.0.12 (Microsoft) Fixed in publication
  • Fix · CNA Dynamics 365 Commerce version 10.0.13 (Microsoft) Fixed in publication
  • Fix · CNA Dynamics 365 Commerce version 10.0.14 (Microsoft) Fixed in publication
  • Fix · CNA Dynamics 365 Commerce version 10.0.15 (Microsoft) Fixed in publication
  • Fix · CNA Dynamics 365 Commerce version 10.0.16 (Microsoft) Fixed in publication

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-16943
  2. 2026-10-03 Alias added: GHSA-cwwh-8p3m-623m

References

Patch 1

  • TI-2018-06256 Improper output encoding in Microsoft Dynamics 365 CVSS 3.0HIGH 8.8
  • TI-2020-12866 Microsoft Dynamics 365 (on-premises) Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2026-31102 Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.9
  • TI-2024-25464 Microsoft Dynamics 365 Elevation of Privilege Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2022-15512 Microsoft Dynamics CRM (on-premises) Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2026-35158 Dynamics 365 Elevation of Privilege Vulnerability CVSS 3.1CRITICAL 9.9
See all 102 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences