CVE-2024-35263
MediumCVSS 5.7Exploitation Probability (EPSS)
Elevated risk74th percentile - higher than 74% of all known CVEs
Summary
An information disclosure vulnerability in Microsoft Dynamics 365 (On-Premises) allows unauthorized users to access sensitive data. The flaw stems from improper access control management of system resources.
Risk Assessment
The organization is at risk of leaking sensitive business data, such as customer records or financial information, potentially leading to data protection violations and reputational damage.
Recommendation
Apply the security update provided by Microsoft for Dynamics 365 (On-Premises) immediately. Test the patch in a non-production environment before deployment.
Other vulnerabilities in Microsoft Dynamics 365
See all- CVE-2026-47647Critical
Improper access control in Microsoft Dynamics 365 allows an authorized attacker to elevate privileges over a network.
- CVE-2026-77908High
Improper control of code generation (code injection) in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.
- CVE-2026-65772High
Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.
- CVE-2026-66301Medium
Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over a network.
- CVE-2026-65815High
Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
- CVE-2026-40371High
A vulnerability in Microsoft Dynamics 365 (on-premises) related to improper permission handling allows an authorized attacker to elevate privileges over a network.
- CVE-2026-33103Medium
Improper access control in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information locally.
- CVE-2024-43476High
Cross-site Scripting (XSS) vulnerability in Microsoft Dynamics 365 (on-premises). Allows an attacker to inject malicious script into the page.
- CVE-2023-21807Medium
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability.
- CVE-2023-21573Medium
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability.
Original NVD description (English source)
Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
Vulnerability data from NVD (NIST) · CISA KEV · EPSS