CVE-2026-40371

Published: Jun 9, 2026Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: secure@microsoft.com (Secondary)

Description

Improper handling of insufficient permissions or privileges in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to elevate privileges over a network.

Affected (1)

Products: Microsoft: Dynamics 365

Microsoft

1 product

Dynamics 365

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Microsoft Dynamics 365	From 9.1 to 9.1.45.11

Related CWEs

CWE-280

Improper Handling of Insufficient Permissions or Privileges

The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.

CWE-755

Improper Handling of Exceptional Conditions

The product does not handle or incorrectly handles an exceptional condition.

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40371

Source: secure@microsoft.com

Vendor Advisory

Timeline

No history available yet.