Skip to content
OpenAdvisories
High MSRC-CVE-2026-40371 1 CVE

Microsoft Dynamics 365 (on-premises) Elevation of Privilege Vulnerability

Published Jun 9, 2026 · Updated Jun 16, 2026 · Revision 3

Vendor: Microsoft

Summary

Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

How could an attacker exploit this vulnerability?
An attacker who is already signed in to the affected Microsoft Dynamics 365 (On‑Premises) system could send a specially crafted request to the vulnerable scenario‑switching page, which does not properly check permissions. By doing so, the attacker could improperly assign themselves the System Administrator role and gain full administrative control of the organization.

What privileges could be gained by an attacker who successfully exploited the vulnerability?
An attacker who successfully exploited this vulnerability could gain administrator privileges.

Security updates
9.1.0045.0011 — https://support.microsoft.com/en-us/topic/service-update-1-45-for-microsoft-dynamics-crm-on-premises-9-1-63e24664-3193-4182-a110-934ee929ce93

Vulnerabilities 1

Revision history

  1. #3

    Updated the fixed version information and download link. The fix was previously believed to be included in Dynamics 365 Server (on-premises) version 6.2; however, it has been confirmed that the fix is included in Dynamics 365 Server v9.1 (on-premises) Update 1.45 (version 9.1.0045.0011). The download link, release notes, and build number has been updated accordingly in the Security Updates table. This is an informational change only.

  2. #2

    The release notes link has been updated to point to the latest available version. This is an informational change only.

  3. #1

    Information published.

References