This vulnerability, identified as CWE-284 (Improper Access Control), exists in Microsoft Dynamics 365 and permits an authorized attacker to elevate their privileges remotely over the network. The CVSS v3.1 base score is 9.9, indicating critical severity with high impact on confidentiality, integrity, and availability. The vulnerability requires low attack complexity, no user interaction, and privileges from an authorized user. Microsoft has released an official fix and manages remediation for this cloud service. No known exploits in the wild have been reported as of the publication date.

Successful exploitation allows an authorized attacker to gain elevated privileges within Microsoft Dynamics 365, potentially compromising confidentiality, integrity, and availability of the system and data. Given the critical CVSS score and the nature of the vulnerability, this could lead to full system compromise or unauthorized access to sensitive information.

Microsoft has released an official fix for this vulnerability and manages remediation for the cloud-hosted Microsoft Dynamics 365 service. Customers should follow the guidance in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47647 to ensure their environments are updated and protected.