This vulnerability in Microsoft Dynamics 365 (on-premises) version 9.0 involves improper access control (CWE-284) that permits an authorized user to disclose information locally. The CVSS 3.1 vector indicates the attack requires local access with low complexity and low privileges, no user interaction, and impacts confidentiality with no impact on integrity or availability. Microsoft has published an official fix and manages remediation for this cloud-hosted service. The vendor advisory is available at the Microsoft Security Response Center.

An authorized attacker with local access can disclose sensitive information due to improper access control. The confidentiality impact is high, but integrity and availability are not affected. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Since this is a cloud service, Microsoft manages remediation server-side. Administrators should apply the official update as recommended in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33103 to address this vulnerability.