Loading story…
Microsoft disclosed multiple cross-site scripting (XSS) vulnerabilities affecting Microsoft Dynamics 365, including on-premises deployments and at least one broader Dynamics 365 issue. The referenced advisories identify CVE-2024-43476, CVE-2023-36410, and CVE-2023-36016 as impacting Microsoft Dynamics 365 (on-premises), while CVE-2024-38166 affects Microsoft Dynamics 365 more generally.
The disclosures indicate that organizations running Dynamics 365 environments may be exposed to web-based script injection risks that could enable malicious content to execute in a user's browser within the application context. Microsoft published security guidance for each issue through the Microsoft Security Response Center, signaling that administrators should review the relevant advisories and apply available updates or mitigations for affected Dynamics 365 systems.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft released a Security Update Guide advisory for CVE-2024-43476, a cross-site scripting vulnerability affecting Microsoft Dynamics 365 (on-premises).
Microsoft released a Security Update Guide advisory for CVE-2024-38166, a cross-site scripting vulnerability affecting Microsoft Dynamics 365.
Microsoft released a Security Update Guide advisory for CVE-2023-36410, a cross-site scripting vulnerability affecting Microsoft Dynamics 365 (on-premises).
Microsoft released a Security Update Guide advisory for CVE-2023-36016, a cross-site scripting vulnerability affecting Microsoft Dynamics 365 (on-premises).
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceportal.msrc.microsoft.com
Open sourceportal.msrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published three high-severity cloud-service vulnerabilities affecting **Microsoft Purview eDiscovery**, **Microsoft Entra ID Entitlement Management**, and **Microsoft Dynamics 365 Online**. The flaws are tracked as `CVE-2026-26150`, `CVE-2026-35431`, and `CVE-2026-32210`, and all are classified as **server-side request forgery (SSRF)** under `CWE-918`. Microsoft tagged each issue as affecting an **exclusively hosted service**, indicating exposure in Microsoft-managed online environments rather than on-premises deployments. According to the CVE records, `CVE-2026-26150` could let an unauthorized attacker elevate privileges over a network in Purview eDiscovery, while `CVE-2026-35431` and `CVE-2026-32210` could enable spoofing in Entra ID Entitlement Management and Dynamics 365 Online. The published `CVSS v3.1` vectors show low attack complexity and no required privileges across all three issues, with Entra ID carrying the broadest potential impact to confidentiality, integrity, and availability, and Dynamics 365 requiring user interaction. Microsoft linked the disclosures to its Security Response Center guidance for customer tracking and remediation.
Jun 29, 2026Microsoft published security advisories for several remote code execution vulnerabilities affecting **SharePoint**, **Microsoft Edge (Chromium-based)**, **Azure Orbital Spatio**, **Azure Virtual Network Gateway**, and **Microsoft Power Pages**, including `CVE-2026-45659`, `CVE-2026-45495`, `CVE-2026-40412`, `CVE-2026-40411`, and `CVE-2026-23652`. The most detailed disclosures focused on SharePoint Server, where Microsoft described `CVE-2026-35439` and `CVE-2026-40357` as **deserialization of untrusted data** flaws that could let authenticated attackers execute arbitrary code over the network on vulnerable servers. Microsoft rated both SharePoint issues **Important** with **CVSS 8.8** and said exploitation requires valid access, with `CVE-2026-35439` requiring at least **Site Owner** privileges and `CVE-2026-40357` requiring **Site Member** permissions. The company said neither flaw had been publicly disclosed or exploited in the wild at publication and assessed exploitation as less likely, while providing fixes that also apply to both **SharePoint Server 2016** and **SharePoint Enterprise Server 2016**. Microsoft also disclosed `CVE-2026-40362`, an **Excel** heap-based buffer overflow that can lead to remote code execution if a user opens a malicious Office file; Microsoft said the Preview Pane is not an attack vector and that a patch is available.
Jul 23, 2026
Microsoft released 22 security updates for cloud and enterprise products, including multiple **critical** vulnerabilities with CVSS scores of `10.0` affecting **Azure SQL Database**, **Exchange Online**, **Azure Arc**, **Azure Managed Instance for Apache Cassandra**, and **Entra ID**. The updates also addressed seven additional critical elevation-of-privilege flaws in **Azure SQL Database**, **Microsoft Fabric**, **Entra ID**, **Azure Logic Apps**, and **Azure Data Factory**. Microsoft said most of the issues were mitigated **server-side**, reducing or eliminating required customer action. One of the most severe issues, `CVE-2026-65801`, is an unauthenticated **server-side request forgery** flaw in **Exchange Online** that can lead to unauthorized privilege escalation over the network. The vulnerability affects only the cloud-hosted service and not on-premises Exchange Server, and Microsoft has already deployed mitigations without requiring customer patching. Public reporting cited no confirmed active exploitation or public proof-of-concept at the time of disclosure, but organizations were urged to review Microsoft 365 security and audit telemetry for suspicious authentication, authorization, or administrative activity.
Aug 25, 2026