CVE-2026-66301: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 on-premises allows an authorized attacker to disclose information over a network...

CVE-2026-40371

Improper handling of insufficient permissions or privileges in Microsoft Dynamics 365 on-premises allows an authorized attacker to elevate privileges over a network...

KLA91092 PE vulnerability in Microsoft Dynamics

Privilege escalation vulnerability was found in Microsoft Dynamics. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2026-40371 Exploitation Related products Microsoft-Dynamics-365 Microsoft-365 CVE list CVE-2026-40371 critical Solution Install necessary...

CVE-2026-40371: Improper Handling of Insufficient Permissions or Privileges

Improper handling of insufficient permissions or privileges in Microsoft Dynamics 365 on-premises allows an authorized attacker to elevate privileges over a network...

CVE-2026-42833

Improper control of generation of code 'code injection' in Microsoft Dynamics 365 on-premises allows an authorized attacker to execute code over a network...

CVE-2026-42898: Improper Control of Generation of Code

Improper control of generation of code 'code injection' in Microsoft Dynamics 365 on-premises allows an authorized attacker to execute code over a network...

Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability

Improper access control in Microsoft Dynamics 365 on-premises allows an authorized attacker to disclose information locally...

CVE-2025-58112

Microsoft Dynamics 365 Customer Engagement on-premises 1612 9.0.2.3034 allows the generation of customized reports via raw SQL queries in an upload of a .rdl Report Definition Language file; this is then processed by the SQL Server Reporting Service. An account with the privilege Add Reporting...

CVE-2025-53728: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 on-premises allows an unauthorized attacker to disclose information over a network...

PT-2024-6654

Name of the Vulnerable Software and Affected Versions: Microsoft Dynamics 365 on-premises affected versions not specified Description: The issue is related to a lack of protection for the web page structure in Microsoft Dynamics 365 On-Premises, which can be exploited by a remote attacker to...

CVE-2024-38211

Microsoft Dynamics 365 on-premises Cross-site Scripting Vulnerability...

CVE-2024-38211: URL Redirection to Untrusted Site

Microsoft Dynamics 365 on-premises Cross-site Scripting Vulnerability...

CVE-2024-30061: Improper Authorization

Microsoft Dynamics 365 On-Premises Information Disclosure Vulnerability...

PT-2024-4972 · Microsoft · Dynamics 365

Name of the Vulnerable Software and Affected Versions: Microsoft Dynamics 365 On-Premises affected versions not specified Description: The issue is related to improper authorization in the local software tool for resource planning in Microsoft Dynamics 365 On-Premises. Exploitation of this issue...

PT-2024-4318

Name of the Vulnerable Software and Affected Versions Microsoft Dynamics 365 On-Premises affected versions not specified Description The issue is related to insufficient protection of service data, which can lead to information disclosure. An attacker, acting remotely, can exploit this to reveal...

CVE-2024-35263: Exposure of Sensitive Information to an Unauthorized Actor

Microsoft Dynamics 365 On-Premises Information Disclosure Vulnerability...

CVE-2024-21419: Improper Neutralization of Input During Web Page Generation

Microsoft Dynamics 365 on-premises Cross-site Scripting Vulnerability...

CVE-2024-21389: Improper Neutralization of Input During Web Page Generation

Microsoft Dynamics 365 on-premises Cross-site Scripting Vulnerability...

CVE-2023-36031

Microsoft Dynamics 365 on-premises Cross-site Scripting Vulnerability...

PT-2023-7032

Name of the Vulnerable Software and Affected Versions Microsoft Dynamics 365 on-premises affected versions not specified Description The issue is related to a lack of protection of the web page structure in Microsoft Dynamics 365, which can lead to cross-site scripting attacks. An attacker can...