D365FO MCP Server EUVD-2026-107365

Exploitation requires that the server was provisioned via the officially documented Azure one-click deployment (infrastructure/azuredeploy.json and infrastructure/main.bicep) with the optional apiKey parameter left at its empty-string default, which propagates to an unset/empty API_KEY App Service setting; apiKeyAuth.ts then passes requests through without authentication while index.ts binds the listener to 0.0.0.0, yielding a publicly reachable App Service. The attacker must additionally be able to reach the /mcp endpoint over the network. Limiting factors that place a deployment OUTSIDE this exposure: a configured API key, effective upstream authentication, or network restrictions blocking attacker access. Note that MCP_SERVER_MODE=read-only does NOT mitigate it - it only limits the exposure to read/search tools (search, get_object_info, batch_get_info, extension_info, security_info, find_references, find_event_handlers). Affected versions are those prior to 1.11.0.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) frames this as a trivially reachable, unauthenticated, network-facing confidentiality breach, and the vector is internally consistent with CWE-306 (Missing Authentication). However, the description makes clear the exposure is conditional on operator behavior: it only arises when a deployer uses the Azure one-click template, leaves the optional apiKey blank, and adds no network restriction or upstream authentication - so the raw PR:N score somewhat overstates universal risk, since correctly keyed or network-restricted deployments are explicitly out of scope. Impact is confidentiality-only (I:N/A:N): the read-only mode permits information disclosure of proprietary X++ source and metadata but not modification or denial of service, so this is a source/IP-leak issue rather than RCE. No EPSS score, no CISA KEV listing, and no public exploit are present in the provided data, so there is no evidence of active exploitation or mass scanning; prioritization should be driven by whether an organization actually ran the keyless public deployment, not by the headline score alone. Key missing signals: EPSS probability is absent and KEV status is not confirmed - treat widespread-exploitation assumptions as unverified.

An organization follows the documented Azure one-click deployment, accepts the default empty apiKey, and leaves the App Service publicly reachable on 0.0.0.0 with no network controls. Because AV:N/AC:L/PR:N, a remote unauthenticated attacker who discovers the /mcp endpoint sends JSON-RPC tools/call requests and invokes read tools such as search and get_object_info to pull indexed X++ source and metadata. No public exploit is identified at time of analysis, but exploitation requires only a standard HTTP client and no special tooling.