CVE-2025-62206
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk62th percentile - higher than 62% of all known CVEs
Summary
A vulnerability in Microsoft Dynamics 365 (on-premises) involves exposure of sensitive information to an unauthorized actor. An unauthenticated attacker can disclose information over a network.
Risk Assessment
An attacker could gain access to sensitive organizational data, potentially leading to confidentiality breaches and further attacks.
Recommendation
Update Microsoft Dynamics 365 (on-premises) to the latest patched version. Restrict network access to the system.
Other vulnerabilities in Microsoft Dynamics 365
See all- CVE-2026-47647Critical
Improper access control in Microsoft Dynamics 365 allows an authorized attacker to elevate privileges over a network.
- CVE-2026-77908High
Improper control of code generation (code injection) in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.
- CVE-2026-65772High
Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.
- CVE-2026-66301Medium
Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over a network.
- CVE-2026-65815High
Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
- CVE-2026-40371High
A vulnerability in Microsoft Dynamics 365 (on-premises) related to improper permission handling allows an authorized attacker to elevate privileges over a network.
- CVE-2026-33103Medium
Improper access control in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information locally.
- CVE-2024-43476High
Cross-site Scripting (XSS) vulnerability in Microsoft Dynamics 365 (on-premises). Allows an attacker to inject malicious script into the page.
- CVE-2024-35263Medium
An information disclosure vulnerability in Microsoft Dynamics 365 (On-Premises) allows unauthorized users to access sensitive data. The flaw stems from improper access control management of system resources.
- CVE-2023-21807Medium
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability.
Original NVD description (English source)
Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclose information over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS