What is the CVSS score of EUVD-2026-25309?

EUVD-2026-25309 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Microsoft Dynamics 365 are affected by EUVD-2026-25309?

Microsoft Dynamics 365 Online contains a critical server-side request forgery vulnerability that could allow attackers to compromise sensitive business data through crafted requests; however, no…. A patch is available.

How to fix or mitigate EUVD-2026-25309?

Within 24 hours, identify all business units and applications dependent on Microsoft Dynamics 365 Online and document their criticality to operations. Within 7 days, confirm via your Microsoft 365 admin portal or Service Health dashboard that the security patch has been deployed to your instances (Dynamics 365 Online receives fixes automatically; no additional action is required from organizations). Within 30 days, document remediation status in your vulnerability management system and review access logs for any suspicious network activity during the update window.

Microsoft Dynamics 365 EUVD-2026-25309

| CVE-2026-32210 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-23 microsoft

GHSA-9m2c-xmjv-v2rr

SSRF Microsoft Microsoft Dynamics 365 Online

9.3

CVSS 3.1 · NVD

Temporal: 8.1

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CIRCL (temporal)

8.1 HIGH

cvss

vuln.today AI

8.2 HIGH

Network-reachable SSRF needing no auth but user interaction (UI:R); scope change (S:C) as the server reaches other systems; high confidentiality but only low integrity given the described spoofing effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:36 vuln.today

EUVD ID Assigned

Apr 23, 2026 - 22:15 euvd

EUVD-2026-25309

Patch released

Apr 23, 2026 - 22:15 nvd

Patch available

CVE Published

Apr 23, 2026 - 21:35 nvd

CRITICAL 9.3

DescriptionCVE.org

Server-side request forgery (ssrf) in Microsoft Dynamics 365 (Online) allows an unauthorized attacker to perform spoofing over a network.

AnalysisAI

Server-side request forgery in Microsoft Dynamics 365 (Online) lets a remote, unauthenticated attacker coerce the cloud service into issuing crafted requests to perform network spoofing, with the CVSS 3.1 score of 9.3 driven by a scope change (S:C) and high confidentiality and integrity impact. Because Dynamics 365 (Online) is a Microsoft-hosted SaaS, exploitation requires victim user interaction (UI:R) and the fix is applied server-side by the vendor. There is no public exploit identified at time of analysis, EPSS is very low (0.04%, 13th percentile), and CISA SSVC scores exploitation as 'none', indicating no observed in-the-wild activity despite the high base score.

Technical ContextAI

The root cause is CWE-918 (Server-Side Request Forgery): the application accepts attacker-influenced input used to build an outbound request, allowing the server to be tricked into contacting an unintended destination. The affected component is Microsoft Dynamics 365 (Online), Microsoft's cloud-hosted CRM/ERP business-application suite (CPE cpe:2.3:a:microsoft:microsoft_dynamics_365_(online):*). In an SSRF against a multi-tenant cloud service, the trust position of the server is what makes it dangerous - the service can typically reach internal endpoints, cloud metadata services, or peer services that an external attacker cannot, which aligns with the scope-change (S:C) metric indicating impact beyond the vulnerable component's own security authority.

RemediationAI

Patch available per vendor advisory: because Dynamics 365 (Online) is a Microsoft-hosted service, Microsoft has remediated the vulnerability server-side and no customer-side patch installation is required - review the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32210 to confirm the fix is deployed to your tenant and whether any tenant-level configuration action is called out. As compensating measures pending confirmation, restrict and monitor Dynamics 365 usage that involves fetching or rendering attacker-supplied URLs, caution users against interacting with untrusted links or content within the application (mitigating the UI:R requirement), and review outbound/network egress logging for anomalous server-initiated requests; the trade-off is largely operational overhead rather than functionality loss since the core fix is vendor-controlled.