CVE-2026-47646: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Microsoft Dynamics 365 Customer Voice
Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Customer Voice allows an unauthorized attacker to perform spoofing over a network.
AI Analysis
Technical Summary
This vulnerability (CVE-2026-47646) in Microsoft Dynamics 365 Customer Voice is a cross-site scripting (CWE-79) flaw caused by improper input neutralization during web page generation. It allows an attacker to conduct spoofing attacks remotely, potentially compromising confidentiality and integrity of data. The vulnerability is rated critical with a CVSS score of 9.3. Being a cloud service, Microsoft manages the remediation and has released an official fix.
Potential Impact
Successful exploitation can lead to spoofing attacks that compromise confidentiality and integrity of user data within Microsoft Dynamics 365 Customer Voice. The high CVSS score (9.3) reflects the critical nature of the vulnerability. There are no reports of active exploitation in the wild currently.
Mitigation Recommendations
Microsoft has issued an official fix for this vulnerability in the cloud-hosted Dynamics 365 Customer Voice service. As this is a cloud service, Microsoft manages the remediation server-side. Users should ensure their service is updated according to Microsoft's guidance. No additional action is required beyond applying the official fix.
CVE-2026-47646: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Microsoft Dynamics 365 Customer Voice
Description
Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Customer Voice allows an unauthorized attacker to perform spoofing over a network.
CVSS v3.1
Score 9.3critical
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-47646) in Microsoft Dynamics 365 Customer Voice is a cross-site scripting (CWE-79) flaw caused by improper input neutralization during web page generation. It allows an attacker to conduct spoofing attacks remotely, potentially compromising confidentiality and integrity of data. The vulnerability is rated critical with a CVSS score of 9.3. Being a cloud service, Microsoft manages the remediation and has released an official fix.
Potential Impact
Successful exploitation can lead to spoofing attacks that compromise confidentiality and integrity of user data within Microsoft Dynamics 365 Customer Voice. The high CVSS score (9.3) reflects the critical nature of the vulnerability. There are no reports of active exploitation in the wild currently.
Mitigation Recommendations
Microsoft has issued an official fix for this vulnerability in the cloud-hosted Dynamics 365 Customer Voice service. As this is a cloud service, Microsoft manages the remediation server-side. Users should ensure their service is updated according to Microsoft's guidance. No additional action is required beyond applying the official fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Microsoft Security Response Center
- Advisory Id
- msrc_CVE-2026-47646
- Cve Count
- 1
- Remediation Level
- official-fix
- Is Cloud Service
- true
Threat ID: 6a35935ff198dc38c1068618
Added to database: 06/19/2026, 19:07:11 UTC
Last enriched: 08/14/2026, 12:53:24 UTC
Last updated: 09/14/2026, 22:01:34 UTC
Views: 365
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.