Dynamics 365 EUVD-2026-29579

Exploitation requires a valid authenticated account with at least low privileges on a Dynamics 365 Customer Insights instance (CVSS PR:L), reachable over the network (AV:N), with no user interaction needed (UI:N) and low attack complexity (AC:L). The scope is changed (S:C), meaning successful abuse can affect resources beyond the attacker's original authorization boundary. The precise product feature, configuration, or request that triggers the improper privilege management is not described in the available sources. The primary limiting factor is the authentication requirement: the attacker must first obtain a legitimate low-privilege account on the tenant; it is not remote-unauthenticated. As a Microsoft-hosted cloud service, the fix is applied by the vendor.

Signals conflict sharply and must be weighed together. The CVSS 3.1 base score of 9.9 is driven by AV:N (network), AC:L (low complexity), PR:L (low-privilege authenticated access), UI:N (no user interaction), scope change (S:C), and total CIA impact (C:H/I:H/A:H) - on paper a near-worst-case privilege-escalation flaw. However, EPSS is only 0.04% (13th percentile), the CVE is NOT listed in CISA KEV, and SSVC records Exploitation: none and Automatable: no (only Technical Impact: total is elevated). So the raw severity reflects potential impact, not observed or likely exploitation. The vuln.today 'act_now' label is driven by the critical score and scope change rather than by any evidence of exploitation. Note also that this is Microsoft's own cloud-delivered Dynamics 365 Customer Insights, so the vendor patches it service-side; traditional 'exposure window' reasoning for on-prem software does not fully apply. Net: treat as a high-impact-if-triggered issue requiring an already-authenticated account, not a widespread-exploitation emergency. The 'act_now' decision label and the near-zero EPSS are the key conflict to reconcile - impact is total but exploitation is currently unobserved and not automatable.

An attacker who already holds a low-privilege authenticated account on a Dynamics 365 Customer Insights tenant abuses improper privilege management to grant themselves elevated rights over the network, without any user interaction. Because the CVSS scope is changed (S:C), the elevated access can extend beyond the originally authorized boundary to impact other components or data. No public exploit is identified and the exact trigger is not described in the available sources.