CVE-2026-40371
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
A vulnerability in Microsoft Dynamics 365 (on-premises) related to improper permission handling allows an authorized attacker to elevate privileges over a network.
Risk Assessment
An authorized attacker can gain higher privileges in Dynamics 365, potentially leading to unauthorized access to data or functions.
Recommendation
Install the security update from Microsoft for Microsoft Dynamics 365 (on-premises).
Other vulnerabilities in Microsoft Dynamics 365
See all- CVE-2026-47647Critical
Improper access control in Microsoft Dynamics 365 allows an authorized attacker to elevate privileges over a network.
- CVE-2026-66301Medium
Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over a network.
- CVE-2026-65815High
Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
- CVE-2026-33103Medium
Improper access control in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information locally.
- CVE-2024-43476High
Cross-site Scripting (XSS) vulnerability in Microsoft Dynamics 365 (on-premises). Allows an attacker to inject malicious script into the page.
- CVE-2024-35263Medium
An information disclosure vulnerability in Microsoft Dynamics 365 (On-Premises) allows unauthorized users to access sensitive data. The flaw stems from improper access control management of system resources.
- CVE-2023-21807Medium
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability.
- CVE-2023-21573Medium
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability.
- CVE-2023-21572Medium
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability.
- CVE-2023-21571Medium
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability.
Original NVD description (English source)
Improper handling of insufficient permissions or privileges in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to elevate privileges over a network.