Dataverse
Monthly
Authentication bypass by spoofing in Microsoft Dataverse - the data backend underlying Power Platform and Dynamics 365 - lets an unauthenticated remote attacker forge a trusted identity assertion and thereby gain elevated privileges over the network, with full impact to confidentiality, integrity, and availability per the assessed CVSS 8.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation is gated by high attack complexity: the attacker must successfully spoof a trusted authentication or identity assertion, which typically requires a condition outside full attacker control (for example a timing/race element or knowledge of environment-specific values) rather than a single deterministic request. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is low at 0.38% (32nd percentile), and CISA's SSVC decision framework rates exploitation as 'none' with 'not automatable', so the AC:H precondition remains the principal factor limiting realistic risk.
Improper handling of insufficient permissions or privileges in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Authentication bypass by spoofing in Microsoft Dataverse - the data backend underlying Power Platform and Dynamics 365 - lets an unauthenticated remote attacker forge a trusted identity assertion and thereby gain elevated privileges over the network, with full impact to confidentiality, integrity, and availability per the assessed CVSS 8.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation is gated by high attack complexity: the attacker must successfully spoof a trusted authentication or identity assertion, which typically requires a condition outside full attacker control (for example a timing/race element or knowledge of environment-specific values) rather than a single deterministic request. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is low at 0.38% (32nd percentile), and CISA's SSVC decision framework rates exploitation as 'none' with 'not automatable', so the AC:H precondition remains the principal factor limiting realistic risk.
Improper handling of insufficient permissions or privileges in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.