This vulnerability, identified as CWE-918, involves a server-side request forgery flaw in Microsoft Dynamics 365 (Online). An attacker can exploit this SSRF to send crafted requests from the server, enabling spoofing over the network. The CVSS v3.1 base score is 9.3, indicating a critical severity with network attack vector, low attack complexity, no privileges required, and user interaction needed. The impact includes high confidentiality and integrity loss but no availability impact. Microsoft has published an official fix and manages patching for this cloud service.

Successful exploitation can lead to an attacker spoofing network requests from the Dynamics 365 server, resulting in high confidentiality and integrity impact. This could allow unauthorized access or manipulation of sensitive data within the service environment. There is no known availability impact. No known exploits are currently observed in the wild.

Microsoft has released an official fix for this vulnerability and manages remediation for the cloud-hosted Dynamics 365 service. Customers should ensure their Dynamics 365 Online environment is updated according to Microsoft's guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32210. No additional action is required beyond applying the official fix as managed by Microsoft.