This vulnerability in Microsoft Dynamics 365 involves improper access control (CWE-284) that enables an attacker with some level of authorization to elevate their privileges remotely over a network. The flaw affects the cloud service version of Microsoft Dynamics 365. Microsoft has released an official fix and manages the remediation for this cloud-hosted service. The CVSS 3.1 base score is 9.9, reflecting critical severity with network attack vector, low attack complexity, no user interaction, and complete impact on confidentiality, integrity, and availability.

An authorized attacker can exploit this vulnerability remotely to gain elevated privileges, potentially leading to full compromise of the affected Microsoft Dynamics 365 environment. The impact includes complete loss of confidentiality, integrity, and availability of the system. Since this is a cloud service, the risk is significant for organizations relying on Microsoft Dynamics 365 for critical business operations.

Microsoft has released an official fix for this vulnerability and manages remediation for the cloud-hosted Microsoft Dynamics 365 service. Customers should ensure their service instances are updated according to Microsoft's guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47647. No additional action is required beyond applying the official fix as managed by Microsoft.