Microsoft Dynamics 365 vulnerabilities
92 known vulnerabilities affecting microsoft/dynamics_365.
Total CVEs
92
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL4HIGH24MEDIUM62LOW2
Vulnerabilities
Page 2 of 5
CVE-2024-30061P3HIGHCVSS 7.3v9.12024-07-09
CVE-2024-30061 [HIGH] CWE-285 CVE-2024-30061: Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
nvd
CVE-2023-35621P3HIGHCVSS 7.5v10.0.37v10.0.382023-12-12
CVE-2023-35621 [HIGH] CWE-799 CVE-2023-35621: Microsoft Dynamics 365 Finance and Operations Denial of Service Vulnerability
Microsoft Dynamics 365 Finance and Operations Denial of Service Vulnerability
nvd
CVE-2025-62206P3MEDIUMCVSS 6.5≥ 9.1, < 9.1.41.072025-11-11
CVE-2025-62206 [MEDIUM] CWE-200 CVE-2025-62206: Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) a
Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2023-35389P3MEDIUMCVSS 6.5≥ 9.0, < 9.0.47.08≥ 9.1, < 9.1.18.222023-08-08
CVE-2023-35389 [MEDIUM] CWE-611 CVE-2023-35389: Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
nvd
CVE-2024-21395P3HIGHCVSS 8.2≥ 9.1, < 9.1.25.172024-02-13
CVE-2024-21395 [HIGH] CWE-79 CVE-2024-21395: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
nvd
CVE-2024-38211P3HIGHCVSS 8.2v9.12024-08-13
CVE-2024-38211 [HIGH] CWE-601 CVE-2024-38211: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
nvd
CVE-2024-21327P3HIGHCVSS 7.6≥ 9.1, < 9.1.25.172024-02-13
CVE-2024-21327 [HIGH] CWE-79 CVE-2024-21327: Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting Vulnerability
Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting Vulnerability
nvd
CVE-2018-8654P3MEDIUMCVSS 6.5v8.02020-01-24
CVE-2018-8654 [MEDIUM] CWE-269 CVE-2018-8654: An elevation of privilege vulnerability exists in Microsoft Dynamics 365 Server, aka 'Microsoft Dyna
An elevation of privilege vulnerability exists in Microsoft Dynamics 365 Server, aka 'Microsoft Dynamics 365 Elevation of Privilege Vulnerability'.
nvd
CVE-2025-53728P3MEDIUMCVSS 6.5≥ 9.1, < 9.1.39.042025-08-12
CVE-2025-53728 [MEDIUM] CWE-200 CVE-2025-53728: Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) a
Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2024-21393P3HIGHCVSS 7.6≥ 9.1, < 9.1.25.172024-02-13
CVE-2024-21393 [HIGH] CWE-79 CVE-2024-21393: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
nvd
CVE-2024-21389P3HIGHCVSS 7.6≥ 9.1, < 9.1.25.172024-02-13
CVE-2024-21389 [HIGH] CWE-79 CVE-2024-21389: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
nvd
CVE-2023-36429P4MEDIUMCVSS 6.5≥ 9.0, < 9.0.50.03≥ 9.1, < 9.1.22.042023-10-10
CVE-2023-36429 [MEDIUM] CWE-643 CVE-2023-36429: Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
nvd
CVE-2023-36433P3MEDIUMCVSS 6.5≥ 9.0, < 9.0.49.04≥ 9.1, < 9.1.21.052023-10-10
CVE-2023-36433 [MEDIUM] CWE-643 CVE-2023-36433: Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
nvd
CVE-2023-35335P4HIGHCVSS 8.2≥ 9.0, < 9.0.47.08≥ 9.1, < 9.1.18.222023-07-11
CVE-2023-35335 [HIGH] CWE-79 CVE-2023-35335: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
nvd
CVE-2021-24101P3MEDIUMCVSS 6.5v8.2v9.02021-02-25
CVE-2021-24101 [MEDIUM] CVE-2021-24101: Microsoft Dataverse Information Disclosure Vulnerability
Microsoft Dataverse Information Disclosure Vulnerability
nvd
CVE-2023-24922P3MEDIUMCVSS 6.5≥ 9.0, < 9.0.45.11≥ 9.1, < 9.1.16.202023-03-14
CVE-2023-24922 [MEDIUM] CWE-643 CVE-2023-24922: Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
nvd
CVE-2019-1008P4MEDIUMCVSS 5.9v8.2v9.02019-05-16
CVE-2019-1008 [MEDIUM] CVE-2019-1008: A security feature bypass vulnerability exists in Dynamics On Premise, aka 'Microsoft Dynamics On-Pr
A security feature bypass vulnerability exists in Dynamics On Premise, aka 'Microsoft Dynamics On-Premise Security Feature Bypass'.
nvd
CVE-2024-35263P4MEDIUMCVSS 5.7v9.12024-06-11
CVE-2024-35263 [MEDIUM] CWE-200 CVE-2024-35263: Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
nvd
CVE-2020-16872P4MEDIUMCVSS 5.4v9.02020-09-11
CVE-2020-16872 [MEDIUM] CWE-79 CVE-2020-16872: <p>A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not pr
A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected Dynamics server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected Dynamics server.
The attacker who successfully exploited the vu
nvd
CVE-2020-16859P4MEDIUMCVSS 5.4v9.02020-09-11
CVE-2020-16859 [MEDIUM] CWE-79 CVE-2020-16859: <p>A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not pr
A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected Dynamics server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected Dynamics server.
The attacker who successfully exploited the vu
nvd