CVE-2025-53728: Microsoft Dynamics 365 (on-premises) version 9.1 · Information Exposure
Affects Microsoft Dynamics 365 (on-premises) version 9.1Source CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 14:05 UTC
- EPSS
- 1.2% chance of exploitation in 30 days – higher than 68% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:CExploitation evidence
Disclosed: evidence found.
CVE published 12 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft Microsoft Dynamics 365 (on-premises) version 9.1 | Affected
| Fixed in– |
AI-suggested
- Restrict network access to Microsoft Dynamics 365 on-premises installations by implementing strict firewall rules and network segmentation to limit exposure to trusted users and systems only.
- Enforce multi-factor authentication and strong access controls to reduce the risk of unauthorized user interaction that could trigger the vulnerability.
- Monitor network traffic and system logs for unusual data access patterns or exfiltration attempts related to Dynamics 365 services.
- Disable or limit features that transmit sensitive information over the network if feasible until a patch is available.
- Prepare for rapid deployment of official patches or updates from Microsoft once released, including testing in controlled environments.
- Conduct security awareness training to inform users about the risks of interacting with potentially malicious content that could trigger the vulnerability.
- Review and tighten data classification and handling policies to minimize the amount of sensitive information accessible through Dynamics 365.
- Engage with Microsoft support and subscribe to security advisories to stay informed about developments related to this vulnerability.
Description
Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclose information over a network.