A server‑side request forgery flaw in Microsoft Dynamics 365 online lets an attacker craft requests that the server sends to arbitrary network resources. This vulnerability is identified as CWE‑918 and carries a CVSS score of 9.3, indicating a high‑severity security risk. An attacker who can trigger the flaw can potentially probe internal services, access sensitive data, or perform other unauthorized network actions.

Microsoft Dynamics 365 (online). All currently deployed instances of the online service are affected; specific version information is not provided, so the issue applies to the entire product family.

The EPSS score of < 1% suggests that active exploitation is currently rare, but the high CVSS score and the fact that the flaw is not listed in the KEV catalog mean that it remains a significant threat. The vulnerability can be leveraged over the network via crafted HTTP requests to the Dynamics 365 service, a scenario that requires no privileged configuration. Because the exploit is known but low‑probability, organizations should not overlook it, especially given the potential for internal network reach.