CVE-20XX-?

Microsoft Dynamics 365 CVEs.

Published CVEs affecting Microsoft Dynamics 365, ranked by exploit odds.

17 CVEs · updated 2026-11-06 03:02 UTC

  1. CVE-2026-65815

    Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.

    Code execution Microsoft Dynamics 365

    8.8 HIGH 2% exploit odds Fix listed
  2. CVE-2026-65772

    Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.

    Code execution Microsoft Dynamics 365

    8.8 HIGH 2% exploit odds Fix listed
  3. CVE-2025-53728

    Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclose information over a network.

    Microsoft Dynamics 365

    6.5 MEDIUM 1% exploit odds Fix listed
  4. CVE-2026-42898

    Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.

    Injection Microsoft Dynamics 365

    9.9 CRITICAL 1% exploit odds Fix listed
  5. CVE-2026-66301

    Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over a network.

    Disclosure Microsoft Dynamics 365

    6.5 MEDIUM 1.0% exploit odds Fix listed
  6. CVE-2026-77908

    Improper control of generation of code ('code injection') in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.

    Injection Microsoft Dynamics 365

    8.8 HIGH 1.0% exploit odds Fix listed
  7. CVE-2025-62206

    Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclose information over a network.

    Microsoft Dynamics 365

    6.5 MEDIUM 1.0% exploit odds Fix listed
  8. CVE-2025-55238

    Dynamics 365 FastTrack Implementation Assets Information Disclosure Vulnerability

    Microsoft Dynamics 365

    7.5 HIGH 0.8% exploit odds Fix listed
  9. CVE-2025-49715

    Exposure of private personal information to an unauthorized actor in Dynamics 365 FastTrack Implementation Assets allows an unauthorized attacker to disclose information over a network.

    Microsoft Dynamics 365

    7.5 HIGH 0.8% exploit odds Fix listed
  10. CVE-2026-47647

    Improper access control in Microsoft Dynamics 365 allows an authorized attacker to elevate privileges over a network.

    Auth & access Microsoft Dynamics 365

    9.9 CRITICAL 0.8% exploit odds Fix listed
  11. CVE-2026-42833

    Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.

    Injection Microsoft Dynamics 365

    9.1 CRITICAL 0.7% exploit odds Fix listed
  12. CVE-2025-62210

    Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.

    Microsoft Dynamics 365

    8.7 HIGH 0.6% exploit odds Fix listed
  13. CVE-2025-62211

    Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.

    Microsoft Dynamics 365

    8.7 HIGH 0.6% exploit odds Fix listed
  14. CVE-2026-40371

    Improper handling of insufficient permissions or privileges in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to elevate privileges over a network.

    Other Microsoft Dynamics 365

    8.8 HIGH 0.6% exploit odds Fix listed
  15. CVE-2026-32210

    Server-side request forgery (ssrf) in Microsoft Dynamics 365 (Online) allows an unauthorized attacker to perform spoofing over a network.

    Disclosure Server Microsoft Dynamics 365

    9.3 CRITICAL 0.6% exploit odds Fix listed
  16. CVE-2025-49745

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to perform spoofing over a network.

    Microsoft Dynamics 365

    5.4 MEDIUM 0.6% exploit odds Fix listed
  17. CVE-2026-33103

    Improper access control in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information locally.

    Auth & access Server Microsoft Dynamics 365

    5.5 MEDIUM 0.2% exploit odds Fix listed

All CVEs affecting Microsoft Dynamics 365 that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.