CVE-2026-47647: Dynamics 365 Elevation of Privilege Vulnerability

Synopsis

An improper access control vulnerability in Microsoft Dynamics 365 allows a network-accessible attacker with a low-privilege account to elevate their privileges to a higher level within the application. The exploit requires no victim interaction and, given the Changed scope in the CVSS vector, a successful attacker gains control that extends beyond the Dynamics 365 application boundary itself, enabling full confidentiality, integrity, and availability impact across affected systems. No fix version has been published; HarborGuard is tracking this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Dynamics 365 service over the network; no physical or local access is needed.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker does not need administrative credentials to trigger the escalation.

• Victim interactionNot required

  No user action is required; the attacker can trigger the vulnerability entirely without involving another person.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, memory layout, or other environmental factors.

Blast Radius

• A successful attacker reads all data accessible within Dynamics 365, including customer records, business data, and stored credentials or session tokens.
• The attacker modifies or deletes persisted records and application configuration across the Dynamics 365 instance.
• The attacker can crash or make the Dynamics 365 service unavailable to legitimate users.
• Because the CVSS scope is Changed, the attacker gains impact that extends beyond the Dynamics 365 process boundary and can affect other systems or services on the same host or adjacent infrastructure.