CVE-2026-40371: Microsoft Dynamics 365 On-Premises Privilege Escalation (CVSS 8.8 HIGH)

Technical summary

CVE-2026-40371 is a privilege escalation vulnerability (CVSS 8.8 HIGH) stemming from improper handling of permission validation in Microsoft Dynamics 365 on-premises. The flaw is cataloged under CWE-280 (Improper Handling of Insufficient Permissions or Privileges) and CWE-755 (Improper Handling of Exceptional Conditions). The attack vector is network-based, requires low complexity, and demands that an attacker already possess legitimate credentials (PR:L). Once exploited, the vulnerability grants high-impact access to confidentiality, integrity, and availability of the affected Dynamics 365 instance. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities catalog.

Business impact

Organizations running Dynamics 365 on-premises face insider threat risk from authenticated users—such as contractors, departed employees with lingering access, or compromised accounts—who could escalate privileges to modify financial records, customer data, or critical business configurations. This can lead to unauthorized data exfiltration, system sabotage, compliance violations, and reputational damage. The scope is limited to authenticated attackers, but their elevated position post-exploit could enable lateral movement or persistence.

Affected systems

Microsoft Dynamics 365 (on-premises deployments) is affected. This advisory does not cover Dynamics 365 cloud (online) instances unless explicitly stated in the vendor advisory. Organizations should verify their deployment architecture—verify whether you operate on-premises, cloud, or a hybrid model—to determine exposure.

Exploitability

Exploitation requires the attacker to possess valid credentials (authenticated access). Network accessibility is required, but the attack itself requires no user interaction or complex conditions. The low attack complexity and direct network path mean that once an attacker gains initial footing with any legitimate account, privilege escalation is trivial to execute. However, the barrier of entry—obtaining valid credentials—limits the threat to insider scenarios or accounts compromised through phishing, credential theft, or lateral movement.

Remediation

Apply the security update provided by Microsoft for Dynamics 365 on-premises. Organizations should prioritize patching systems in environments where multiple privileged-access roles exist or where guest/contractor accounts have broad baseline permissions. Interim mitigations may include restricting network access to Dynamics 365 on-premises systems via firewall rules, enforcing multi-factor authentication for all user accounts, and conducting access reviews to remove or downgrade unnecessary permissions for low-privilege roles.

Patch guidance

Monitor Microsoft's security update releases and vendor advisories for patched versions of Dynamics 365 on-premises. Apply patches to all affected instances in a staged manner, beginning with non-production environments to validate compatibility. Verify patch installation by confirming the version number against the official Microsoft advisory. Organizations should consult the Microsoft Dynamics 365 on-premises support lifecycle to understand which versions receive security updates.

Detection guidance

Monitor Dynamics 365 audit logs for privilege escalation attempts, including role assignments, permission grants, or access to sensitive tables by low-privilege accounts. Use Security Information and Event Management (SIEM) tools to correlate authentication events with subsequent privilege escalations. Search for unusual API calls or administrative operations initiated by accounts that do not typically perform such actions. If Dynamics 365 is integrated with Microsoft Sentinel or Microsoft Defender for Cloud, leverage built-in detections for privilege escalation patterns.

Why prioritize this

CVE-2026-40371 scores CVSS 8.8 (HIGH) due to the complete compromise of confidentiality, integrity, and availability once an attacker escalates privileges. Although exploitation requires prior authentication, the ease of execution (low complexity, no user interaction) and the high impact make this a critical priority for organizations running on-premises Dynamics 365. Insider threat scenarios and post-compromise lateral movement amplify the risk. Patching should be treated as urgent.

Risk score, explained

The CVSS 8.8 rating reflects: (1) Network-based attack surface (AV:N), (2) Low attack complexity—no special conditions needed once authenticated (AC:L), (3) Requirement for low-level privileges (PR:L), ensuring that any authenticated user can attempt exploitation, (4) No user interaction required (UI:N), enabling automated or opportunistic attacks, and (5) Unrestricted impact on confidentiality, integrity, and availability (C:H/I:H/A:H). The vulnerability does not cross scope boundaries (S:U), but its impact within a single Dynamics 365 instance is severe. The combination of ease of execution and complete system compromise justifies the HIGH severity.

Frequently asked questions