CVE-2026-122196: Microsoft Dynamics 365 (on-premises) Information Disclosure Vulnerability
Published Nov 10, 2026
·Updated
Improper restriction of xml external entity reference in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over a network.
Other sources
Microsoft Dynamics 365 (on-premises) Information Disclosure Vulnerability
— Microsoft
Affected Software
1 affected component
Microsoft Power Apps
Event History
Nov 10, 2026
CVE Published
via Microsoft·04:00 PM
Data Sourced
via Microsoft·04:00 PM
DescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·06:20 PM
Data Sourced
via MITRE·06:20 PM
DescriptionSeverity
Data Sourced
via NVD·07:20 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker must be authorized and able to reach the affected Microsoft Dynamics 365 (on-premises) deployment over the network. The provided data does not indicate that unauthenticated users can exploit it.
2
What is the likely impact of successful exploitation?
Successful exploitation can disclose information. The supplied vector indicates high confidentiality impact, with no indicated integrity or availability impact.
3
What vulnerability class is involved?
This is an XML external entity (XXE/XEE) issue caused by improper restriction of XML external entity references.