Priority MEDIUM 43
Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01694 · Published 2026-09-08 · Fixed in 9.1.0046.0006 CWE-502
Priority MEDIUM 42
Improper control of generation of code ('code injection') in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00987 · Published 2026-09-08 · Fixed in 9.1.0048.0004 CWE-94
Priority LOW 31
Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00995 · Published 2026-08-11 · Fixed in 9.1.0047.0006 CWE-200
Priority MEDIUM 43
Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01694 · Published 2026-08-11 · Fixed in 9.1.0047.0006 CWE-502
Priority MEDIUM 44
Improper access control in Microsoft Dynamics 365 allows an authorized attacker to elevate privileges over a network.
CVSS 3.1CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.00778 · Published 2026-06-18 · No fix listed CWE-284
Priority MEDIUM 41
Improper handling of insufficient permissions or privileges in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0063 · Published 2026-06-09 · Fixed in 9.1.0045.0011 CWE-280
Priority MEDIUM 43
Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
CVSS 3.1CRITICAL 9.1· Network · High privileges · No interaction · EPSS 0.00748 · Published 2026-05-12 · Fixed in 9.1.45.11 CWE-250
Priority MEDIUM 45
Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
CVSS 3.1CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.01194 · Published 2026-05-12 · Fixed in 9.1.45.11 CWE-94
Priority MEDIUM 43
Server-side request forgery (ssrf) in Microsoft Dynamics 365 (Online) allows an unauthorized attacker to perform spoofing over a network.
CVSS 3.1CRITICAL 9.3· Network · No auth · User interaction · EPSS 0.00584 · Published 2026-04-23 · No fix listed CWE-918
Priority LOW 24
Improper access control in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information locally.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00221 · Published 2026-04-14 · Fixed in 9.1.0044.0015 CWE-284
Priority MEDIUM 41
Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.
CVSS 3.1HIGH 8.7· Network · Low privileges · User interaction · EPSS 0.00643 · Published 2025-11-11 · Fixed in 8.8.139.398 CWE-79
Priority MEDIUM 41
Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.
CVSS 3.1HIGH 8.7· Network · Low privileges · User interaction · EPSS 0.00643 · Published 2025-11-11 · Fixed in 8.8.139.398 CWE-79
Priority LOW 31
Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00984 · Published 2025-11-11 · Fixed in 9.1.41.07 CWE-200
Priority MEDIUM 40
Dynamics 365 FastTrack Implementation Assets Information Disclosure Vulnerability
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00848 · Published 2025-09-04 · No fix listed CWE-284
Priority LOW 31
Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01265 · Published 2025-08-12 · Fixed in 9.1.39 CWE-200
Priority LOW 25
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to perform spoofing over a network.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.00582 · Published 2025-08-12 · Fixed in 9.1.38.10 CWE-79
Priority MEDIUM 40
Exposure of private personal information to an unauthorized actor in Dynamics 365 FastTrack Implementation Assets allows an unauthorized attacker to disclose information over a network.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00833 · Published 2025-06-20 · No fix listed CWE-359
Priority LOW 35
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVSS 3.1HIGH 7.6· Network · Low privileges · User interaction · EPSS 0.0089 · Published 2024-09-10 · Fixed in 9.1.32 CWE-79
Priority LOW 38
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVSS 3.1HIGH 8.2· Network · No auth · User interaction · EPSS 0.00998 · Published 2024-08-13 · Fixed in 1.31 CWE-601
Priority MEDIUM 45
Weak authentication in Microsoft Dynamics 365 allows an unauthenticated attacker to elevate privileges over a network.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00884 · Published 2024-07-31 · No fix listed CWE-1390
Priority LOW 37
Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
CVSS 3.1HIGH 7.3· Network · Low privileges · User interaction · EPSS 0.01373 · Published 2024-07-09 · Fixed in 9.1.28.09 CWE-285
Priority LOW 29
Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
CVSS 3.1MEDIUM 5.7· Network · Low privileges · User interaction · EPSS 0.01669 · Published 2024-06-11 · Fixed in 1.29 CWE-200
Priority LOW 35
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVSS 3.1HIGH 7.6· Network · Low privileges · User interaction · EPSS 0.01078 · Published 2024-03-12 · Fixed in 9.1.26 CWE-79
Priority LOW 38
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVSS 3.1HIGH 8.2· Network · No auth · User interaction · EPSS 0.0114 · Published 2024-02-13 · Fixed in 9.1.25.17 CWE-79
Priority LOW 36
Dynamics 365 Sales Spoofing Vulnerability
CVSS 3.1HIGH 7.6· Network · Low privileges · User interaction · EPSS 0.01316 · Published 2024-02-13 · Fixed in 9.1.25.17 CWE-79
Load more
THREATIST.IORead the docs