Loading vulnerability…
Microsoft Dataverse Authentication Bypass by Spoofing
CVE-2026-77903 is an authentication-bypass-by-spoofing vulnerability in Microsoft Dataverse, an exclusively hosted service. An unauthenticated attacker can exploit the flaw remotely over a network to elevate privileges. The underlying implementation details and affected Dataverse components have not been disclosed. The vulnerability is rated CVSS 9.0 with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables a remote unauthenticated attacker to obtain elevated privileges in a changed security scope. The CVSS assessment indicates high potential impact to confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
Apply least privilege to Dataverse roles, service identities, and connected integrations. Review tenant activity for suspicious role assignments, API activity, and resource changes, and investigate anomalous privileged operations. Restrict and review unnecessary integrations and permissions until the service-side fix is confirmed.
Patch, then assume compromise.
Microsoft Dataverse is a Microsoft-managed hosted service; customers cannot independently apply a platform patch. Verify that Microsoft has deployed the relevant remediation to affected tenancies and monitor Microsoft security advisories for service-status or tenant-specific actions.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.