What is the CVSS score of CVE-2026-33821?

CVE-2026-33821 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Dynamics 365 are affected by CVE-2026-33821?

A privilege elevation vulnerability in Microsoft Dynamics 365 Customer Insights allows authenticated users to escalate their permissions beyond their assigned role, potentially enabling access to…. A patch is available.

How to fix or mitigate CVE-2026-33821?

Within 24 hours, inventory all Microsoft Dynamics 365 Customer Insights instances across your organization and assess current access control configurations; notify system owners and security teams of the patch requirement. Within 7 days, deploy the vendor-released patch to all production and staging environments after validating it in a test instance; coordinate the deployment to minimize business disruption. Within 30 days, conduct an access control audit to verify proper privilege separation is restored and review user activity logs dating back 30 days to detect any unauthorized privilege escalation attempts.

Dynamics 365 CVE-2026-33821

EUVD-2026-29579 HIGH

Improper Privilege Management (CWE-269)

2026-05-12 microsoft

GHSA-5rhg-q7gx-pwvw

Privilege Escalation Microsoft Dynamics 365

7.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

ENISA EUVD

HIGH

qualitative

vuln.today AI

7.7 HIGH

Authenticated foothold is required so PR:L; network-reachable cloud service with low complexity gives AV:N/AC:L/UI:N, and scope-crossing privilege abuse yields S:C with I:H, C:N/A:N per vendor scoping.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:00 vuln.today

CVE Published

May 12, 2026 - 16:59 nvd

HIGH 7.7

DescriptionCVE.org

Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege elevation in Microsoft Dynamics 365 Customer Insights allows an already-authenticated network attacker to gain higher privileges than their assigned role should permit, owing to improper privilege management (CWE-269). The flaw carries a CVSS 3.1 base score of 7.7 with a scope change, meaning the impact crosses the initial security boundary into other components. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA's SSVC assessment records no known exploitation, but a vendor patch is available.

Technical ContextAI

Dynamics 365 Customer Insights is Microsoft's cloud-hosted customer data platform (CDP) within the broader Dynamics 365 business-application suite (CPE cpe:2.3:a:microsoft:dynamics_365). The root cause is CWE-269 Improper Privilege Management, a class of defect where the application fails to correctly assign, enforce, or restrict privileges - for example allowing a lower-privileged role to perform actions reserved for administrators, or to manipulate authorization boundaries. Because the CVSS vector reports a scope change (S:C), the vulnerable authorization logic sits in one security authority but the impact reaches resources governed by a different one, consistent with a multi-tenant/cloud service where role boundaries are enforced across components.

RemediationAI

Patch available per vendor advisory - apply the Microsoft update referenced in the MSRC guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33821; because Dynamics 365 Customer Insights is a Microsoft-hosted cloud service, remediation is largely applied by Microsoft on the service side, so administrators should confirm their tenant is on the fixed service build and apply any tenant-side updates or configuration changes the advisory specifies. As compensating controls until confirmed patched, tighten role-based access so that only trusted users hold the low-privilege accounts needed to reach the vulnerable functionality, review and prune Customer Insights role and permission assignments to reduce the pool of accounts that could abuse the flaw, and enable auditing/monitoring of privilege changes and administrative actions to detect anomalous elevation. These controls reduce the exploitable population and improve detection but do not remove the underlying defect. No exact fix version string is published in the provided data (cloud service build), so verify remediation status directly against the MSRC advisory rather than a version number.