Microsoft Dynamics 365 CVE-2026-66301

Exploitation requires a valid low-privilege authenticated account on the target Microsoft Dynamics 365 on-premises instance (confirmed by CVSS PR:L). The attack is conducted over the network (AV:N), so the attacker must have network connectivity to the Dynamics 365 web endpoint - typically an internal network or VPN. No user interaction is required from a victim. Exploitation is not automatable per SSVC, indicating manual steps are involved. Factors limiting exploitation include: the requirement for a pre-existing authenticated session (rules out unauthenticated external attackers), the on-premises-only scope (cloud-hosted Dynamics 365 customers are unaffected), and the absence of known public exploit code at time of analysis.

The CVSS base score of 6.5 (Medium) is well-calibrated for this vulnerability. The PR:L metric confirms an authenticated attacker is required, significantly narrowing the attack surface to internal users or external actors who have already obtained valid credentials. SSVC assessment reinforces this: Exploitation is rated 'none' (no observed active exploitation), Automatable is 'no' (manual exploitation steps required), and Technical Impact is 'partial' (information disclosure without integrity or availability consequence). There is no CISA KEV listing and no publicly available proof-of-concept code, making opportunistic mass exploitation unlikely. The primary real-world risk is insider threat or lateral movement following credential compromise. No conflicting signals exist between CVSS and SSVC for this CVE.

An authenticated Dynamics 365 user with a low-privilege account - such as a salesperson or support agent - sends a crafted network request to a vulnerable on-premises instance, triggering the information disclosure flaw and retrieving sensitive records (such as financial data, customer PII, or business-critical records) that their role should not permit them to access. No public proof-of-concept code is known to exist, meaning exploitation currently requires knowledge of the specific flaw mechanics.