The vulnerability arises from improper access control in Microsoft Dynamics 365 on‑premises. An attacker who has authorized access can read sensitive data that should be protected, exposing confidential information. This weakness is classified as a lack of proper authorization checks.

Vulnerable systems include Microsoft Dynamics 365 (on‑premises) version 9.0. The attack is limited to installations that run this version and do not have the latest security updates applied.

The CVSS score of 5.5 indicates a medium severity. The exploit requires that the attacker already possesses legitimate local credentials and that no additional conditions are needed. Because the attack vector is local and the vulnerability is not listed in the KEV catalog, the likelihood of widespread exploitation is moderate but still warrants timely remediation. Applying the vendor’s security update is the recommended approach.