This vulnerability in Microsoft Dynamics 365 involves improper access control (CWE-284) that permits an authorized attacker to escalate privileges remotely. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, no user interaction, and complete impact on confidentiality, integrity, and availability. Microsoft manages remediation for this cloud service and has issued an official fix as per their security advisory.

An attacker with authorized access to Microsoft Dynamics 365 can exploit this vulnerability to gain elevated privileges, potentially leading to full compromise of the affected system's data and functionality. The vulnerability impacts confidentiality, integrity, and availability at a critical level.

Microsoft has provided an official fix for this vulnerability. Since Microsoft Dynamics 365 is a cloud service, the vendor manages remediation server-side. Users and administrators should ensure their service instances are updated according to Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47647. No additional action is required beyond applying the official fix.