Microsoft Dynamics 365 (on-premises): XXE information disclosure
Summary
Microsoft Dynamics 365 (on-premises) contains an XML external entity (XXE) reference flaw that Microsoft classifies as an information disclosure vulnerability. An attacker with a valid low-privileged account and network access to the application can abuse XML processing to read data the server can access, such as configuration files. No user interaction is required, and confidentiality is the only impact (CVSS 3.1: 6.5, Medium).
Affected
- Microsoft Dynamics 365 (on-premises) from 1710 (9.2.23071.136) before the November 2026 update, according to the CVE record (CNA: Microsoft)
- Naming discrepancy: the CVE record also lists Microsoft Power Apps; the Dynamics product is treated as the scope, to be confirmed with MSRC
Fixed in
- Unknown. Microsoft published the fix in the November 2026 Patch Tuesday release, but the fixed build number could not be verified. Check the MSRC advisory or the Dynamics 365 update table.
Workaround
- No vendor workaround identified.
- Interim generic measures: restrict Dynamics accounts to users who need them and check whether XML-processing features accepting user-supplied XML are exposed.
Exploitation
- Not known to be exploited in the wild; not listed in CISA KEV.
- No public proof of concept found.
- Rapid7 rates exploitation as less likely. CISA SSVC: exploitation none, automatable no.
Our recommendation
- Confirm the installed Dynamics 365 build and compare it with the fixed version on the MSRC page.
- Install the November 2026 update on all application and front-end servers.
- If Dynamics is internet-facing, ensure access control and MFA are in place and review recent logins.
- Check which service account runs the Dynamics application server and limit its file access.
- Re-check MSRC and CISA KEV for changes.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-122196 msrc.microsoft.com
- CVE Record CVE-2026-122196 www.cve.org
- BleepingComputer: Microsoft November 2026 Patch Tuesday www.bleepingcomputer.com
- Rapid7: Patch Tuesday November 2026 www.rapid7.com
- Strix.ai: CVE-2026-122196 www.strix.ai
- Cybersecurity News: Microsoft November 2026 Patch Tuesday cybersecuritynews.com
- Vulners: CVE-2023-35389 (earlier Dynamics 365 XXE) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 12:03.
Original description (NVD)
Improper restriction of xml external entity reference in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.