Read the docs
TI-2023-17732 Aliases CVE-2023-35621GHSA-w23x-3qjg-4q5c

Microsoft Dynamics 365 Finance and Operations Denial of Service Vulnerability

Priority LOW 37CWE-799Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from Microsoft.

Summary

Microsoft Dynamics 365 Finance and Operations Denial of Service Vulnerability

Why it matters now

EPSS 0.02339 83rd percentileScored 2026-11-07
Fix Fixed Dynamics 365 for Finance and Operations (Microsoft): 7.0.7120.46, 7.0.7068.109, 7.0.7036.133

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftDynamics 365 for Finance and Operations10.0.38 to before 7.0.7120.467.0.7120.46Patch availableCNA
MicrosoftDynamics 365 for Finance and Operations10.0.37 to before 7.0.7068.1097.0.7068.109Patch availableCNA
MicrosoftDynamics 365 for Finance and Operations10.0.32 to before 7.0.7036.1337.0.7036.133Patch availableCNA
  • Dynamics 365 for Finance and Operations VendorMicrosoft Affected 10.0.38 to before 7.0.7120.46 Fixed in 7.0.7120.46 Patch available CNA
  • Dynamics 365 for Finance and Operations VendorMicrosoft Affected 10.0.37 to before 7.0.7068.109 Fixed in 7.0.7068.109 Patch available CNA
  • Dynamics 365 for Finance and Operations VendorMicrosoft Affected 10.0.32 to before 7.0.7036.133 Fixed in 7.0.7036.133 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:dynamics_365:-:*:*:*:*:finance_and_operations:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:a:microsoft:dynamics_365:10.0.37:*:*:*:*:finance_and_operations:*:*10.0.37VulnerableMicrosoft
cpe:2.3:a:microsoft:dynamics_365:10.0.38:*:*:*:*:finance_and_operations:*:*10.0.38VulnerableMicrosoft
  • cpe:2.3:a:microsoft:dynamics_365:-:*:*:*:*:finance_and_operations:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:dynamics_365:10.0.37:*:*:*:*:finance_and_operations:*:* Versions 10.0.37 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:dynamics_365:10.0.38:*:*:*:*:finance_and_operations:*:* Versions 10.0.38 Vulnerable ·Microsoft

Remediation

  • Fix · CNA Dynamics 365 for Finance and Operations (Microsoft) Fixed in 7.0.7120.46
  • Fix · CNA Dynamics 365 for Finance and Operations (Microsoft) Fixed in 7.0.7068.109
  • Fix · CNA Dynamics 365 for Finance and Operations (Microsoft) Fixed in 7.0.7036.133

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Denial of Service
Exploited
No
Publicly disclosed
—
Exploitability
Exploitation Less Likely
ProductStatusPlan or fix
Dynamics 365 for Finance and Operations Platform Update 60Fixed 7.0.7036.133 · Security Update
Dynamics 365 for Finance and Operations Version 10.0.37 Platform Update 61Fixed 7.0.7068.109 · Security Update
Dynamics 365 for Finance and Operations Version 10.0.38 Platform Update 62Fixed 7.0.7120.46 · Security Update

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-35621
  2. 2026-10-03 Alias added: GHSA-w23x-3qjg-4q5c

References

Patch 1

  • TI-2018-06256 Improper output encoding in Microsoft Dynamics 365 CVSS 3.0HIGH 8.8
  • TI-2020-12866 Microsoft Dynamics 365 (on-premises) Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2026-31102 Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.9
  • TI-2024-25464 Microsoft Dynamics 365 Elevation of Privilege Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2022-15512 Microsoft Dynamics CRM (on-premises) Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2026-35158 Dynamics 365 Elevation of Privilege Vulnerability CVSS 3.1CRITICAL 9.9
See all 102 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences