{"id":"CVE-2026-122196","kind":"vulnerability","aliases":["CVE-2026-122196"],"related":[],"title":"Microsoft Dynamics 365 on-premises: XML entity flaw leaks data to authorized users","description":"Improper restriction of xml external entity reference in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over a network.","summary":"Microsoft Dynamics 365 (on-premises) does not properly restrict XML external entity references, a flaw class known as XXE. An authorized attacker can read information from the server over the network.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dynamics-365","on-premises","vendor","windows"],"not_affected_if":["auth-required","cloud-hosted"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:20:36+00:00","first_seen_at":"2026-11-10T19:25:11+00:00","triaged_at":"2026-11-10T19:56:19+00:00","updated_at":"2026-11-10T19:56:19+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-10T19:56:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Dynamics 365 on-premises: XML entity flaw leaks data to authorized users","impact":"low","summary":"Microsoft Dynamics 365 (on-premises) does not properly restrict XML external entity references, a flaw class known as XXE. An authorized attacker can read information from the server over the network.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["dynamics-365","on-premises","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Server information is disclosed to an authorized network user","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-122196 for affected builds and the patched version.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["cloud-hosted","auth-required"],"who_is_affected":"Organizations that run Microsoft Dynamics 365 on their own servers rather than the hosted cloud service. The sources do not say which versions or configurations are affected, or which features accept XML input. Cloud-only users are not covered by this entry.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000673,"input_tokens":4509,"output_tokens":445,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-122196':17A,20A '-2026':16A,19A '-365':22B '365':3A,30B,70C 'allow':74C 'attack':50B,77C 'author':13A,49B,76C 'class':44B 'cve':15A,18A 'data':11A 'disclos':79C 'dynam':2A,21B,29B,69C 'entiti':8A,40B,65C 'extern':39B,64C 'flaw':9A,43B 'improp':60C 'inform':53B,80C 'known':45B 'leak':10A 'microsoft':1A,28B,68C 'network':59B,83C 'on-premis':4A,23B,31B,71C 'premis':6A,25B,33B,73C 'proper':36B 'read':52B 'refer':41B,66C 'restrict':37B,61C 'server':56B 'user':14A 'vendor':26B 'window':27B 'xml':7A,38B,63C 'xxe':47B","nicknames":[],"mitigations":[],"who_affected":"Organizations that run Microsoft Dynamics 365 on their own servers rather than the hosted cloud service. The sources do not say which versions or configurations are affected, or which features accept XML input. Cloud-only users are not covered by this entry.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dynamics365","medium","onpremises","vendor","windows"],"campaign_type":null,"search_a":"'-122196':17A,20A '-2026':16A,19A '365':3A 'author':13A 'cve':15A,18A 'data':11A 'dynam':2A 'entiti':8A 'flaw':9A 'leak':10A 'microsoft':1A 'on-premis':4A 'premis':6A 'user':14A 'xml':7A","search_b":"'-365':22B '365':30B 'attack':50B 'author':49B 'class':44B 'dynam':21B,29B 'entiti':40B 'extern':39B 'flaw':43B 'inform':53B 'known':45B 'microsoft':28B 'network':59B 'on-premis':23B,31B 'premis':25B,33B 'proper':36B 'read':52B 'refer':41B 'restrict':37B 'server':56B 'vendor':26B 'window':27B 'xml':38B 'xxe':47B","search_c":"'365':70C 'allow':74C 'attack':77C 'author':76C 'disclos':79C 'dynam':69C 'entiti':65C 'extern':64C 'improp':60C 'inform':80C 'microsoft':68C 'network':83C 'on-premis':71C 'premis':73C 'refer':66C 'restrict':61C 'xml':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122196","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122196","severity":null,"published_at":"2026-11-10T19:20:36+00:00","modified_at":"2026-11-10T19:20:36+00:00","first_seen_at":"2026-11-10T19:25:11+00:00","fetched_at":"2026-11-10T19:25:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}