The vulnerability permits an authorized user to disclose sensitive data that should be protected from unauthorized actors. Over a network, the attacker can retrieve such information, constituting an information disclosure weakness (CWE‑200). The description explicitly notes that confidential information may be exposed to an unauthorized actor, making confidentiality the primary concern.

Affected systems are Microsoft Dynamics 365 (on‑premises) version 9.1. No other versions or products are listed in the current data.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of < 1% suggests a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, further indicating limited current threat. The likely attack vector is remote network access, requiring the attacker to be an authorized user or possess credentials to access the Dynamics 365 instance. Successful exploitation could lead to disclosure of confidential business or customer data over the network.