CVE-2026-47646

CriticalCVSS 9.3

Published: 09/07/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability in Dynamics 365 Customer Voice allows an unauthorized attacker to perform spoofing over a network due to improper input neutralization during web page generation.

Risk Assessment

An attacker can inject malicious scripts, leading to session theft, redirects, or display of fraudulent content, compromising user trust and data integrity.

Recommendation

Immediately update Dynamics 365 Customer Voice to the latest patched version and implement input validation and encoding in web applications.

Original NVD description (English source)

Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Customer Voice allows an unauthorized attacker to perform spoofing over a network.