What is the CVSS score of CVE-2026-47646?

CVE-2026-47646 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.5%.

Which versions of Dynamics 365 Customer Voice are affected by CVE-2026-47646?

Microsoft Dynamics 365 Customer Voice contains a critical cross-site scripting vulnerability enabling remote, unauthenticated attackers to inject malicious scripts into customer survey workflows.. A patch is available.

How to fix or mitigate CVE-2026-47646?

Within 24 hours: Audit all Dynamics 365 Customer Voice deployments in production; disable external survey sharing and restrict access to internal authenticated users only; alert stakeholders of the vulnerability. Within 7 days: Deploy Web Application Firewall rules blocking XSS patterns on Customer Voice endpoints; implement Content Security Policy headers; enable comprehensive audit logging for survey creation and recipient interactions. Within 30 days: Monitor Microsoft Security Advisories for patch release; assess compromised survey data for unauthorized modifications; develop migration timeline for alternative feedback platforms if vendor patch is unavailable beyond 30 days.

Dynamics 365 Customer Voice CVE-2026-47646

EUVD-2026-42491 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-09 secure@microsoft.com

GHSA-vp2c-mc92-v364

XSS Microsoft Dynamics 365 Customer Voice

6.1

CVSS 3.1 · NVD

Temporal: 8.1

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CIRCL (temporal)

8.1 HIGH

cvss

vuln.today AI

6.1 MEDIUM

Network XSS needing victim interaction (UI:R) with a scope change into the app context; spoofing yields limited confidentiality/integrity impact, so C:L/I:L rather than H.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jul 09, 2026 - 18:52 NVD

CRITICAL MEDIUM

CVSS changed

Jul 09, 2026 - 18:52 NVD

9.3 (CRITICAL) 6.1 (MEDIUM)

Analysis Generated

Jul 09, 2026 - 00:29 vuln.today

DescriptionNVD

Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Customer Voice allows an unauthorized attacker to perform spoofing over a network.

AnalysisAI

Cross-site scripting in Microsoft Dynamics 365 Customer Voice allows a remote, unauthenticated attacker to inject script that executes in a victim's browser session and perform spoofing once the victim interacts with attacker-supplied content. The flaw carries a CVSS 9.3 rating driven largely by a scope change (S:C), meaning injected script escapes into a different security context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Dynamics 365 Customer Voice is Microsoft's cloud-based enterprise feedback and survey management service within the Dynamics 365 / Power Platform family, used to build and distribute surveys and collect customer responses. The root cause is CWE-79 (improper neutralization of input during web page generation), where user-controllable input - plausibly survey content, response fields, or shared survey links rendered in the web UI - is emitted into an HTML page without adequate output encoding, allowing browser-interpreted markup or script. The CVSS scope change (S:C) indicates the executed script affects a security context beyond the vulnerable component, consistent with script running in the context of the Dynamics 365 web application or an authenticated user's session.

RemediationAI

Because Dynamics 365 Customer Voice is a Microsoft-operated cloud service, the fix is applied by Microsoft server-side and no customer-installed patch is typically required; consult the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47646 to confirm remediation status and any tenant-side action. Patch available per vendor advisory; no discrete fixed version number was provided in the input, consistent with SaaS servicing. As compensating measures while verifying the fix, restrict distribution and acceptance of survey links to trusted audiences, educate users not to interact with unsolicited Customer Voice survey links (directly reducing the UI:R exploitation path, at the cost of some legitimate survey reach), and enforce browser/endpoint controls and a strong Content Security Policy where configurable to limit script execution. Monitor the MSRC guide entry for this CVE to confirm Microsoft has completed the service-side remediation for your tenant.