EUVD-2026-82585
GHSA-7f9r-6785-2v6v
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated (AV:N/PR:N) spoofing bypass, but AC:H reflects the spoofing/race prerequisite; auth bypass grants full principal access so C/I/A all High.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.
AnalysisAI
Authentication bypass by spoofing in Microsoft Dataverse - the data backend underlying Power Platform and Dynamics 365 - lets an unauthenticated remote attacker forge a trusted identity assertion and thereby gain elevated privileges over the network, with full impact to confidentiality, integrity, and availability per the assessed CVSS 8.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation is gated by high attack complexity: the attacker must successfully spoof a trusted authentication or identity assertion, which typically requires a condition outside full attacker control (for example a timing/race element or knowledge of environment-specific values) rather than a single deterministic request. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation targets Microsoft Dataverse (the Power Platform/Dynamics 365 data backend) over the network with no authentication and no user interaction (PR:N/UI:N), but is gated by high attack complexity (AC:H): the attacker must successfully spoof a trusted authentication/identity assertion, which typically implies a condition outside full attacker control such as a timing/race element or knowledge of environment-specific values rather than a single deterministic request. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a CVSS 8.1 (High) authentication-bypass-by-spoofing flaw (CWE-290) in Microsoft Dataverse. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Because Dataverse is a Microsoft-hosted service, the primary fix is delivered service-side by Microsoft and requires no customer-installed patch; per the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77903) customers should confirm the current status and any tenant/environment-specific guidance directly, since the provided data contains no exact fixed version - the applicable status at time of analysis is 'Patch available per vendor advisory'. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Microsoft Dataverse, Power Platform, and Dynamics 365 instances in your environment, assess exposure, and enable enhanced logging and monitoring for anomalous authentication attempts; restrict network access to these services where feasible and enforce multi-factor authentication for all administrative and user accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network. R
Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network. Rated
Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network. Rated
Improper handling of insufficient permissions or privileges in Microsoft Dataverse allows an authorized attacker to elev
Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network. R
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today