This vulnerability (CVE-2026-40371) in Microsoft Dynamics 365 (on-premises) version 9.1 is due to improper handling of insufficient permissions or privileges, classified under CWE-280. It enables an authorized attacker to elevate privileges remotely over a network, potentially leading to full compromise of confidentiality, integrity, and availability. The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required. Microsoft has issued an official fix for this vulnerability. The product is a cloud service, so remediation is managed by the vendor.

Successful exploitation allows an authorized attacker to elevate privileges remotely, resulting in high impact on confidentiality, integrity, and availability of the affected system. This could lead to unauthorized access and control over sensitive data and system functions within Microsoft Dynamics 365 (on-premises).

An official fix is available from Microsoft for this vulnerability. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users should ensure their Microsoft Dynamics 365 (on-premises) installations are updated to the fixed version as per the vendor advisory. Patch status is confirmed as official-fix.