What is the CVSS score of EUVD-2026-35532?

EUVD-2026-35532 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Dynamics 365 are affected by EUVD-2026-35532?

Microsoft Dynamics 365 on-premises deployments face a privilege escalation vulnerability (CVE-2026-40371, CVSS 8.8) that allows authenticated users with basic access to gain elevated privileges…. A patch is available.

How to fix or mitigate EUVD-2026-35532?

Within 24 hours: Identify all on-premises Dynamics 365 deployments and their network locations; implement emergency network segmentation to restrict administrative access and enable monitoring for privilege escalation attempts. Within 7 days: Audit all Dynamics 365 user accounts and revoke excessive privilege grants; establish continuous monitoring and alerting for unauthorized privilege escalation; escalate with Microsoft for patch timeline and status. Within 30 days: Deploy multi-factor authentication for all Dynamics 365 administrative and sensitive access; validate real-time alerting for suspicious account activity is functioning; incorporate compensating controls into incident response procedures.

Microsoft Dynamics 365 EUVD-2026-35532

| CVE-2026-40371 HIGH

Improper Handling of Insufficient Permissions or Privileges (CWE-280)

2026-06-09 secure@microsoft.com

GHSA-q5cq-75qj-crvp

Information Disclosure Microsoft Dynamics 365

8.8

CVSS 3.1 · Vendor: microsoft

Temporal: 7.7

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

7.7 HIGH

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 17:33 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 8.8

DescriptionCVE.org

Improper handling of insufficient permissions or privileges in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation in Microsoft Dynamics 365 (on-premises) allows a remote authenticated attacker with low-level access to gain elevated privileges across the network due to improper handling of insufficient permissions. With a CVSS score of 8.8 and full impact on confidentiality, integrity, and availability, this issue is significant for organizations running on-premises Dynamics 365 deployments. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

Microsoft Dynamics 365 is an enterprise CRM/ERP platform that, in its on-premises form, runs on customer-managed Windows Server infrastructure with SQL Server backends. The root cause maps to CWE-280 (Improper Handling of Insufficient Permissions or Privileges), meaning the application fails to correctly evaluate or enforce permission states when carrying out privileged operations. In practice this class of bug commonly stems from missing authorization checks on specific entity operations, role-assignment endpoints, or business-process flows, allowing a user with limited rights to invoke functions intended for higher-privileged roles.

RemediationAI

Apply the security update published by Microsoft via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40371 as the primary remediation; exact fix build numbers are not included in the supplied data and should be retrieved from that advisory. Until patching is complete, restrict network reachability of the Dynamics 365 application tier to trusted user networks only, audit and tighten Dynamics 365 security roles to enforce least privilege (particularly removing unnecessary write/assign privileges on sensitive entities), and increase monitoring on role-assignment, privilege-change, and administrative audit events within Dynamics - recognising that role tightening may disrupt legitimate business workflows and that network restriction does not block authenticated internal attackers who already meet the PR:L requirement.