CVE-2026-33103 Details
Description
Improper access control in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information locally.
A vulnerability exists in Microsoft Dynamics 365 (on-premises) due to improper access control, allowing an authorized attacker to locally disclose sensitive information.
Users can download the security update for Microsoft Dynamics 365 (on-premises) version 9.0 from the Microsoft Update Catalog. For more information, refer to the Microsoft Knowledge Base article 5078943.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33103 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| microsoft dynamics 365 | >= 9.0, < 9.1.44.15 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 28, 2026 | Initial Analysis | [email protected] |
| Apr 14, 2026 | New CVE Received | [email protected] |