CVE-2026-33103: Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
CVE-2026-33103 is an information disclosure vulnerability in Microsoft Dynamics 365 (On-Premises), rated Important by Microsoft, with a CVSS 3.1 base score of 5.5 (Medium). An attacker can exploit it by an attacker with local access, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as unlikely. The EPSS model estimates a 0.22% probability of exploitation activity in the next 30 days, higher than 13% of all scored vulnerabilities. Microsoft released the fix on 14 April 2026 in the April 2026 Patch Tuesday, delivered through 1 security update (KB5078943). It affects 1 product in 1 product family (Microsoft Dynamics).
Key facts
- CVE ID
- CVE-2026-33103
- Severity
- Medium CVSS 5.5
- Microsoft severity
- Important
- Impact
- Information Disclosure
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Unlikely
- Weakness
- CWE-284
- EPSS
- 0.22% (percentile 13%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- April 2026 Patch Tuesday
- Product families
- Microsoft Dynamics
CVSS score and vector
Microsoft scores CVE-2026-33103 at 5.5 (temporal 4.8) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | None |
| Availability impact | None |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Description
Improper access control in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information locally.
Frequently asked questions (Microsoft)
What type of information could be disclosed by this vulnerability?
The type of information that could be disclosed if an attacker successfully exploited this vulnerability is sensitive information.
Affected products (1)
Microsoft Dynamics
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Microsoft Dynamics 365 (on-premises) version 9.0 | KB5078943 | Security Update | 9.1.0044.0015 | Maybe |
Security updates (1)
- KB5078943 (Security Update)
NIST NVD data
- NVD status
- Analyzed
- NVD CVSS
- 5.5 (MEDIUM)
- NVD weakness
- CWE-284
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| dynamics 365 | from 9.0, before 9.1.44.15 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33103 (Vendor Advisory)
Acknowledgments
- 41ae55e9310ff27fa6f26af4727e5590
- Hoangnx and hoangha with VCSLab of Viettel Cyber Security
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. | |
| 1.1 | Added acknowledgements. This is an informational change only. |