This vulnerability (CVE-2026-32210) in Microsoft Dynamics 365 (online) is classified as CWE-918 (Server-Side Request Forgery). It enables an attacker without privileges to cause the server to make unauthorized network requests, leading to spoofing attacks. The CVSS 3.1 base score is 9.3 (critical), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high confidentiality and integrity impacts. The service is cloud-hosted, and Microsoft has released an official fix. No known exploits are reported in the wild as of the publication date.

Successful exploitation can lead to unauthorized network spoofing, compromising confidentiality and integrity of data processed by Microsoft Dynamics 365 (online). Availability impact is not indicated. The vulnerability does not require privileges but does require user interaction. The scope of impact extends beyond the vulnerable component.

Microsoft has released an official fix for this vulnerability and manages remediation for the cloud-hosted Microsoft Dynamics 365 (online) service. Customers should ensure their service instances are updated according to Microsoft's guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32210. No additional user action is required beyond applying the official fix.