What is the CVSS score of EUVD-2025-21174?

EUVD-2025-21174 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Dynamics 365 are affected by EUVD-2025-21174?

A vulnerability in Dynamics 365 FastTrack Implementation Assets exposes sensitive personal information to unauthorized actors, creating potential compliance and reputational risk for organizations…

How to fix or mitigate EUVD-2025-21174?

Within 24 hours: Identify all Dynamics 365 FastTrack Implementation Assets instances in use and audit access logs for unauthorized activity. Within 7 days: Implement network segmentation to restrict access to affected systems and conduct a data exposure assessment to determine what personal information may have been accessed. Within 30 days: Deploy compensating controls such as enhanced monitoring, implement stricter authentication policies, and establish a communication plan for potentially affected individuals pending vendor patch availability.

Dynamics 365 EUVD-2025-21174

| CVE-2025-49715 HIGH

Exposure of Private Personal Information to an Unauthorized Actor (CWE-359)

2025-06-20 secure@microsoft.com

Information Disclosure Microsoft Dynamics 365

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-21174

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

CVE Published

Jun 20, 2025 - 01:15 nvd

HIGH 7.5

DescriptionCVE.org

Exposure of private personal information to an unauthorized actor in Dynamics 365 FastTrack Implementation Assets allows an unauthorized attacker to disclose information over a network.

AnalysisAI

CVE-2025-49715 is a private personal information disclosure vulnerability in Microsoft Dynamics 365 FastTrack Implementation Assets that allows unauthenticated network-based attackers to access sensitive user data without any user interaction. The vulnerability has a CVSS score of 7.5 (High) with confirmed high confidentiality impact, and affects organizations using Dynamics 365 FastTrack resources. Given the network-accessible nature and lack of authentication requirements, this poses significant risk to enterprise customer data security.

Technical ContextAI

This vulnerability exists in Dynamics 365 FastTrack Implementation Assets, which are cloud-based resources supporting enterprise Microsoft Dynamics 365 deployments. The underlying issue is classified as CWE-359 (Privacy Violation), indicating improper access control over personally identifiable information (PII). The vulnerability stems from inadequate authorization checks that fail to prevent unauthorized disclosure of private data over network channels. FastTrack assets typically include implementation guides, templates, and configuration resources that may inadvertently contain or provide pathways to customer PII stored within linked Dynamics 365 environments. The attack vector is Network (AV:N) with Low Attack Complexity (AC:L), meaning no special network proximity is required and exploitation does not depend on target configuration nuances.

RemediationAI

Immediate actions: (1) Contact Microsoft Security Response Center (MSRC) or check the Microsoft Security Update Guide for CVE-2025-49715 to obtain specific patch versions and deployment timelines. (2) Audit all FastTrack Implementation Assets in use to identify what PII may have been accessible. (3) Review access logs to determine if unauthorized access occurred. (4) Until patched, implement network-level access controls to restrict FastTrack resource endpoints to authorized users only. (5) Temporarily restrict or remove sensitive PII from FastTrack repositories pending patch deployment. (6) Follow Microsoft's official remediation guidance available through their security advisories portal. (7) Establish a timeline to deploy security updates immediately upon release; do not delay given network accessibility and lack of exploitation barriers.