CVE-2026-40371: Microsoft Dynamics 365 (on-premises) Elevation of Privilege Vulnerability

Synopsis

An elevation-of-privilege vulnerability exists in Microsoft Dynamics 365 (on-premises) stemming from improper handling of insufficient permissions. The flaw is reachable over the network by any authenticated user holding a low-privilege account, with no additional interaction required. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected Dynamics 365 instance. A patched-image rebuild at version 9.1.0045.0011 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Dynamics 365 service over the network; there is no local or physical access requirement.

• AuthenticationRequired

  The attacker must hold a valid account on the system, though any low-privilege account is sufficient to exploit this vulnerability.

• Victim interactionNot required

  No victim action such as clicking a link or opening a file is needed; the attacker can exploit this entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• A successful attacker reads confidential data stored within the Dynamics 365 instance, including business records, user data, and application configuration.
• The attacker modifies or deletes persisted records and application data within the Dynamics 365 database.
• The attacker disrupts or crashes the Dynamics 365 service, causing an outage for all users of the on-premises deployment.
• Starting from a low-privilege account, the attacker gains elevated control equivalent to a higher-privileged role within the application.