This vulnerability (CVE-2026-33103) in Microsoft Dynamics 365 (on-premises) version 9.0 involves improper access control (CWE-284) that permits an authorized local attacker to disclose information. The CVSS 3.1 base score is 5.5, reflecting a medium severity with local attack vector, low attack complexity, and no user interaction required. The confidentiality impact is high, while integrity and availability are not affected. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known active exploitation has been reported.

An authorized attacker with local access to Microsoft Dynamics 365 (on-premises) version 9.0 can exploit this vulnerability to disclose sensitive information. The confidentiality impact is high, but integrity and availability remain unaffected. There are no reports of active exploitation in the wild.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users should apply the official update as provided in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33103 to address this vulnerability.