What is the CVSS score of CVE-2026-47647?

CVE-2026-47647 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Microsoft Dynamics 365 are affected by CVE-2026-47647?

Microsoft Dynamics 365 contains a privilege escalation vulnerability (CVSS 9.9) that permits authenticated low-privileged users to gain elevated system rights with cross-organizational scope,…. A patch is available.

How to fix or mitigate CVE-2026-47647?

Within 24 hours: Inventory all Dynamics 365 deployments and identify users with low-privilege accounts; implement access logging and alerts for privilege escalation attempts. Within 7 days: Apply the Microsoft-released patch per MSRC guidance across all Dynamics 365 instances and validate successful deployment. Within 30 days: Conduct audit of privilege escalation events during the vulnerability window and review access control policies for least-privilege enforcement.

Microsoft Dynamics 365 CVE-2026-47647

EUVD-2026-37947 CRITICAL

Improper Access Control (CWE-284)

2026-06-18 microsoft

GHSA-vq29-76j3-6vh5

Authentication Bypass Microsoft Microsoft Dynamics 365

9.9

CVSS 3.1 · Vendor: microsoft

Temporal: 8.6

Severity by source

Vendor (microsoft) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CIRCL (temporal)

8.6 HIGH

cvss

vuln.today AI

9.9 CRITICAL

Network-reachable Dynamics 365 endpoint, low complexity, requires any authenticated low-priv user (PR:L), no UI; scope changes across authorization boundary with full CIA impact post-escalation.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 18, 2026 - 22:18 vuln.today

CVE Published

Jun 18, 2026 - 21:42 cve.org

CRITICAL 9.9

DescriptionCVE.org

Improper access control in Microsoft Dynamics 365 allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation in Microsoft Dynamics 365 allows authenticated low-privileged users to gain elevated rights across a network due to improper access control enforcement. The flaw carries a critical CVSS 9.9 score with scope change, indicating impact beyond the vulnerable component, and Microsoft has issued a patch via MSRC. No public exploit identified at time of analysis, and the vector's Exploit Code Maturity is rated Unproven.

Technical ContextAI

Microsoft Dynamics 365 is an enterprise SaaS/on-premises suite spanning CRM, ERP, sales, customer service, and finance modules, typically integrated with Azure AD/Entra ID and exposing role-based access control across business entities and APIs. The root cause is CWE-284 (Improper Access Control), meaning the application fails to correctly enforce authorization checks on a privileged operation or resource, letting a lower-privileged authenticated principal perform actions reserved for higher roles. The scope-change (S:C) in the CVSS vector indicates the authorization boundary crossed is broader than the vulnerable component - likely affecting tenants, organizations, or downstream identity-protected resources rather than only the Dynamics module itself.

RemediationAI

Apply the Microsoft-released patch as documented in MSRC advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47647; for Dynamics 365 Online tenants Microsoft typically rolls out fixes through the service automatically, but administrators should verify their tenant build and any required customer-side action in the Power Platform admin center. For self-managed or on-premises deployments, schedule the update immediately and confirm the exact build/version listed by MSRC before deployment. Until patched, compensating controls include tightening role assignments to enforce least privilege (audit security roles and team memberships), restricting network exposure of Dynamics endpoints to VPN or Conditional Access trusted locations, enabling Entra ID risk-based Conditional Access to limit low-trust authenticated sessions, and increasing audit log review for unusual privilege changes - noting these reduce but do not eliminate risk since the flaw is post-authentication.