This vulnerability (CVE-2026-33103) involves improper access control in Microsoft Dynamics 365 (on-premises) version 9.0, which permits an authorized attacker to disclose information locally. The CVSS 3.1 vector indicates the attack requires local access with low complexity and low privileges, no user interaction, and impacts confidentiality with no impact on integrity or availability. Microsoft has published an official fix and manages remediation for this cloud-hosted service. There are no known exploits in the wild.

An authorized attacker with local access can disclose sensitive information due to improper access control. The confidentiality impact is high, but integrity and availability are not affected. This could lead to unauthorized information disclosure within the affected environment.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users should apply the official update as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33103 to address this vulnerability.