What is the CVSS score of CVE-2026-66301?

CVE-2026-66301 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.7%.

Is there a patch available for CVE-2026-66301?

Yes, a patch is available for CVE-2026-66301. Update the affected software to the latest version immediately.

Microsoft Dynamics 365 CVE-2026-66301

EUVD-2026-56566 MEDIUM

Information Exposure (CWE-200)

2026-08-11 secure@microsoft.com

GHSA-7vjr-7vwf-vqhc

Information Disclosure Microsoft Dynamics 365

6.5

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable endpoint requires low-privilege authentication; high confidentiality impact for unauthorized data access; no integrity or availability consequence identified.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 22:15 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:19 nvd

MEDIUM 6.5

DescriptionCVE.org

Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over a network.

AnalysisAI

Microsoft Dynamics 365 on-premises version 9.1 exposes sensitive information to authenticated network attackers via an improper access control flaw (CWE-200), allowing disclosure of data beyond a user's authorization level. The CVSS vector (PR:L) confirms exploitation requires a valid low-privilege account, limiting exposure to insider threats or compromised credentials rather than unauthenticated external actors. No public exploit code and no active exploitation have been identified; SSVC rates this as non-automatable with partial technical impact, consistent with a medium-priority finding.

Technical ContextAI

The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating a failure in access control or data segregation logic within the application layer. The affected product is Microsoft Dynamics 365 on-premises, version 9.1 (specifically builds prior to 9.1.0047.0006), a widely deployed enterprise resource planning and customer relationship management platform. The on-premises variant is distinct from the cloud-hosted Dynamics 365 service, meaning this flaw affects self-hosted customer environments rather than Microsoft's managed infrastructure. The network attack vector (AV:N) indicates the vulnerable endpoint is reachable over the network, consistent with Dynamics 365's web-based interface.

RemediationAI

The primary remediation is to update Microsoft Dynamics 365 on-premises version 9.1 to build 9.1.0047.0006 or later, as confirmed by the vendor patch advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66301. If immediate patching is not feasible, compensating controls should include auditing and restricting user role assignments within Dynamics 365 to enforce least-privilege access, which reduces the pool of accounts that could trigger or benefit from the disclosure. Network segmentation to limit which internal users can reach the Dynamics 365 instance over the network provides additional defense in depth, though this does not eliminate the flaw. Enhanced logging of sensitive data access queries within Dynamics 365 can aid in detecting potential exploitation attempts.