This vulnerability (CVE-2026-32210) is a server-side request forgery (CWE-918) issue in Microsoft Dynamics 365 (online), a cloud service by Microsoft. It enables an attacker without privileges to spoof network requests, potentially compromising confidentiality and integrity of data. The CVSS v3.1 base score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. Microsoft has published an official fix and manages patching for this cloud service. No known active exploitation has been reported.

Successful exploitation can lead to high confidentiality and integrity impact by allowing an attacker to spoof network requests within the Microsoft Dynamics 365 (online) environment. This could result in unauthorized access or manipulation of sensitive data. Availability impact is not affected. The vulnerability is critical given the CVSS score of 9.3 and the cloud service context.

Microsoft has released an official fix for this vulnerability and manages remediation for the cloud-hosted Microsoft Dynamics 365 (online) service. Customers should ensure their service instances are updated according to Microsoft's guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32210. No additional customer action is required beyond applying the official fix as provided by Microsoft.