Dynamics 365 (Microsoft) - vulnerabilities (CVEs)

109 CVEs, 0 in the last 30 days, 101 known versions, newest CVE from 2026-09-08. Vendor: Microsoft.

CVEs of Dynamics 365

CVE-2026-65772 - CVSS 8.8 (high), 2026-09-08: Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.
CVE-2026-77908 - CVSS 8.8 (high), 2026-09-08: Improper control of generation of code ('code injection') in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.
CVE-2026-66301 - CVSS 6.5 (medium), 2026-08-11: Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over…
CVE-2026-65815 - CVSS 8.8 (high), 2026-08-11: Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
CVE-2026-47647 - CVSS 9.9 (critical), 2026-06-18: Improper access control in Microsoft Dynamics 365 allows an authorized attacker to elevate privileges over a network.
CVE-2026-40371 - CVSS 8.8 (high), 2026-06-09: Improper handling of insufficient permissions or privileges in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to elevate privileges over a…
CVE-2026-42898 - CVSS 9.9 (critical), 2026-05-12: Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
CVE-2026-42833 - CVSS 9.1 (critical), 2026-05-12: Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
CVE-2026-33821 - CVSS 9.9 (critical), 2026-05-12: Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a network.
CVE-2026-32210 - CVSS 9.3 (critical), 2026-04-23: Server-side request forgery (ssrf) in Microsoft Dynamics 365 (Online) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-33103 - CVSS 5.5 (medium), 2026-04-14: Improper access control in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information locally.
CVE-2025-62211 - CVSS 8.7 (high), 2025-11-11: Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to…
CVE-2025-62210 - CVSS 8.7 (high), 2025-11-11: Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to…
CVE-2025-62206 - CVSS 6.5 (medium), 2025-11-11: Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclose information…
CVE-2025-55238 - CVSS 7.5 (high), 2025-09-04: Dynamics 365 FastTrack Implementation Assets Information Disclosure Vulnerability
CVE-2025-53728 - CVSS 6.5 (medium), 2025-08-12: Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclose information…
CVE-2025-49745 - CVSS 5.4 (medium), 2025-08-12: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker…
CVE-2025-49715 - CVSS 7.5 (high), 2025-06-20: Exposure of private personal information to an unauthorized actor in Dynamics 365 FastTrack Implementation Assets allows an unauthorized attacker to disclose…
CVE-2024-43476 - CVSS 7.6 (high), 2024-09-10: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2024-38211 - CVSS 8.2 (high), 2024-08-13: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2024-38182 - CVSS 9.8 (critical), 2024-07-31: Weak authentication in Microsoft Dynamics 365 allows an unauthenticated attacker to elevate privileges over a network.
CVE-2024-30061 - CVSS 7.3 (high), 2024-07-09: Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
CVE-2024-35263 - CVSS 5.7 (medium), 2024-06-11: Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
CVE-2024-30048 - CVSS 7.6 (high), 2024-05-14: Dynamics 365 Customer Insights Spoofing Vulnerability
CVE-2024-30047 - CVSS 7.6 (high), 2024-05-14: Dynamics 365 Customer Insights Spoofing Vulnerability
CVE-2024-21419 - CVSS 7.6 (high), 2024-03-12: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2024-21393 - CVSS 7.6 (high), 2024-02-13: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2024-21396 - CVSS 7.6 (high), 2024-02-13: Dynamics 365 Sales Spoofing Vulnerability
CVE-2024-21395 - CVSS 8.2 (high), 2024-02-13: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2024-21394 - CVSS 7.6 (high), 2024-02-13: Dynamics 365 Field Service Spoofing Vulnerability
CVE-2024-21389 - CVSS 7.6 (high), 2024-02-13: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2024-21327 - CVSS 7.6 (high), 2024-02-13: Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting Vulnerability
CVE-2024-21328 - CVSS 7.6 (high), 2024-02-13: Dynamics 365 Sales Spoofing Vulnerability
CVE-2023-36020 - CVSS 7.6 (high), 2023-12-12: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-35621 - CVSS 7.5 (high), 2023-12-12: Microsoft Dynamics 365 Finance and Operations Denial of Service Vulnerability
CVE-2023-36410 - CVSS 7.6 (high), 2023-11-14: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-36031 - CVSS 7.6 (high), 2023-11-14: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-36030 - CVSS 6.1 (medium), 2023-11-14: Microsoft Dynamics 365 Sales Spoofing Vulnerability
CVE-2023-36016 - CVSS 6.2 (medium), 2023-11-14: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-36433 - CVSS 6.5 (medium), 2023-10-10: Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
CVE-2023-36429 - CVSS 6.5 (medium), 2023-10-10: Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
CVE-2023-36416 - CVSS 6.1 (medium), 2023-10-10: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-38164 - CVSS 7.6 (high), 2023-09-12: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-36886 - CVSS 7.6 (high), 2023-09-12: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-36800 - CVSS 7.6 (high), 2023-09-12: Dynamics Finance and Operations Cross-site Scripting Vulnerability
CVE-2023-35389 - CVSS 6.5 (medium), 2023-08-08: Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
CVE-2023-24896 - CVSS 5.4 (medium), 2023-07-14: Dynamics 365 Finance Spoofing Vulnerability
CVE-2023-35335 - CVSS 8.2 (high), 2023-07-11: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-33171 - CVSS 8.2 (high), 2023-07-11: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-28314 - CVSS 6.1 (medium), 2023-04-11: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-28313 - CVSS 6.1 (medium), 2023-04-11: Microsoft Dynamics 365 Customer Voice Cross-Site Scripting Vulnerability
CVE-2023-28309 - CVSS 7.6 (high), 2023-04-11: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-24922 - CVSS 6.5 (medium), 2023-03-14: Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
CVE-2023-24921 - CVSS 5.4 (medium), 2023-03-14: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-24920 - CVSS 5.4 (medium), 2023-03-14: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-24919 - CVSS 5.4 (medium), 2023-03-14: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-24891 - CVSS 5.4 (medium), 2023-03-14: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-24879 - CVSS 5.4 (medium), 2023-03-14: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-21778 - CVSS 8 (high), 2023-02-14: Microsoft Dynamics Unified Service Desk Remote Code Execution Vulnerability
CVE-2023-21807 - CVSS 6.5 (medium), 2023-02-14: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-21572 - CVSS 6.5 (medium), 2023-02-14: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-21571 - CVSS 5.4 (medium), 2023-02-14: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-21573 - CVSS 5.4 (medium), 2023-02-14: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-21570 - CVSS 5.4 (medium), 2023-02-14: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2022-35805 - CVSS 8.8 (high), 2022-09-13: Microsoft Dynamics CRM (on-premises) Remote Code Execution Vulnerability
CVE-2022-34700 - CVSS 8.8 (high), 2022-09-13: Microsoft Dynamics CRM (on-premises) Remote Code Execution Vulnerability
CVE-2022-23259 - CVSS 8.8 (high), 2022-04-15: Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
CVE-2022-21957 - CVSS 7.2 (high), 2022-02-09: Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
CVE-2022-21932 - CVSS 7.6 (high), 2022-01-11: Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting Vulnerability
CVE-2021-42316 - CVSS 8.8 (high), 2021-11-10: Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
CVE-2021-41353 - CVSS 5.4 (medium), 2021-10-13: Microsoft Dynamics 365 (on-premises) Spoofing Vulnerability
CVE-2021-41354 - CVSS 5.4 (medium), 2021-10-13: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2021-40457 - CVSS 7.4 (high), 2021-10-13: Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting Vulnerability
CVE-2021-36950 - CVSS 5.4 (medium), 2021-08-12: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2021-34524 - CVSS 8.8 (high), 2021-08-12: Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
CVE-2021-28461 - CVSS 6.1 (medium), 2021-05-11: Dynamics Finance and Operations Cross-site Scripting Vulnerability
CVE-2021-24101 - CVSS 6.5 (medium), 2021-02-25: Microsoft Dataverse Information Disclosure Vulnerability
CVE-2020-17158 - CVSS 8.8 (high), 2020-12-10: Microsoft Dynamics 365 for Finance and Operations (on-premises) Remote Code Execution Vulnerability
CVE-2020-17152 - CVSS 8.8 (high), 2020-12-10: Microsoft Dynamics 365 for Finance and Operations (on-premises) Remote Code Execution Vulnerability
CVE-2020-17147 - CVSS 8.7 (high), 2020-12-10: Dynamics CRM Webclient Cross-site Scripting Vulnerability
CVE-2020-17021 - CVSS 5.4 (medium), 2020-11-11: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2020-17018 - CVSS 5.4 (medium), 2020-11-11: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2020-17005 - CVSS 5.4 (medium), 2020-11-11: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2020-16978 - CVSS 5.4 (medium), 2020-10-16: A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an…
CVE-2020-16956 - CVSS 5.4 (medium), 2020-10-16: A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an…
CVE-2020-16943 - CVSS 6.5 (medium), 2020-10-16: An elevation of privilege vulnerability exists in Microsoft Dynamics 365 Commerce. An unauthenticated attacker who successfully exploited this…
CVE-2020-16859 - CVSS 5.4 (medium), 2020-09-11: A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an…
CVE-2020-16862 - CVSS 8.8 (high), 2020-09-11: A remote code execution vulnerability exists in Microsoft Dynamics 365 (on-premises) when the server fails to properly sanitize web requests to an affected…
CVE-2020-16872 - CVSS 7.6 (high), 2020-09-11: A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an…
CVE-2020-16861 - CVSS 5.4 (medium), 2020-09-11: A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an…
CVE-2020-16871 - CVSS 5.4 (medium), 2020-09-11: A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an…
CVE-2020-16860 - CVSS 8.8 (high), 2020-09-11: A remote code execution vulnerability exists in Microsoft Dynamics 365 (on-premises) when the server fails to properly sanitize web requests to an affected…
CVE-2020-16864 - CVSS 5.4 (medium), 2020-09-11: A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an…
CVE-2020-16878 - CVSS 5.4 (medium), 2020-09-11: A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an…
CVE-2020-16858 - CVSS 5.4 (medium), 2020-09-11: A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an…
CVE-2020-16857 - CVSS 8.8 (high), 2020-09-11: A remote code execution vulnerability exists in Microsoft Dynamics 365 for Finance and Operations (on-premises) version 10.0.11. An attacker who…
CVE-2020-1591 - CVSS 5.4 (medium), 2020-08-17: A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an…
CVE-2020-1182 - CVSS 8 (high), 2020-08-17: A remote code execution vulnerability exists in Microsoft Dynamics 365 for Finance and Operations (on-premises) version 10.0.11. An attacker who successfully…
CVE-2020-1063 - CVSS 5.4 (medium), 2020-05-21: A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an…
CVE-2018-8654 - CVSS 6.5 (medium), 2020-01-24: An elevation of privilege vulnerability exists in Microsoft Dynamics 365 Server, aka 'Microsoft Dynamics 365 Elevation of Privilege Vulnerability'.