NCSC-2026-0288 [1.00] [M/H] Vulnerabilities patched in Microsoft Dynamics
Microsoft has patched vulnerabilities in Dynamics, both online and on-premise. The vulnerabilities allow an attacker to elevate privileges, execute arbitrary code, and/or access sensitive data. The most severe vulnerability has been assigned the identifier CVE-2026-59118 and is located in Power Apps. However, this vulnerability has already been centrally patched by Microsoft itself and is included for informational purposes only. No further action is required for this vulnerability.
CSIRTS triage
- What
- Multiple vulnerabilities in Dynamics allow privilege elevation, arbitrary code execution, and sensitive data access.
- Who is affected
- Deployments of Microsoft Dynamics both online and on-premise are affected.
- Urgency
- Low—Microsoft has already centrally patched these vulnerabilities; no further action is required.
- Action
- No action needed as patches have been centrally deployed by Microsoft.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Dynamics
Get an email when a new Dynamics advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0288
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-591180.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-59118 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[NEW] [high] Microsoft Dynamics: Multiple vulnerabilitiescert-bund
- criticalCVE-2026-59118: Copilot Cowork Elevation of Privilege Vulnerabilitymsrc
- high[NEW] [high] Microsoft Power Apps: Vulnerability enables privilege escalationcert-bund
- criticalCVE-2026-59118: Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges…nvd
Recent advisories for Microsoft Dynamics
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- high[NEW] [high] Microsoft Dynamics: Multiple vulnerabilitiescert-bund · 2026-08-14
- mediumCVE-2026-66301: Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premi…nvd · 2026-08-11
- highCVE-2026-65815: Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized…nvd · 2026-08-11
- mediumCVE-2026-66301: Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerabilitymsrc · 2026-08-11
- highCVE-2026-65815: Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerabilitymsrc · 2026-08-11
- mediumCVE-2026-40375: Microsoft Dynamics Business Central Information Disclosure Vulnerabilitymsrc · 2026-08-11
More from NCSC-NL Advisories
- unknownNCSC-2026-0302 [1.00] [M/H] Vulnerabilities patched in SAP Commerce Cloud Data Hub Adapter2026-08-15
- unknownNCSC-2026-0301 [1.00] [M/H] Vulnerabilities patched in IBM i operating system by IBM2026-08-14
- unknownNCSC-2026-0300 [1.00] [M/H] Vulnerabilities patched in Fortinet FortiWeb2026-08-13
- unknownNCSC-2026-0299 [1.00] [M/H] Vulnerability patched in Fortinet FortiManager2026-08-13
- unknownNCSC-2026-0298 [1.00] [M/H] Vulnerabilities patched in Autodesk AutoCAD2026-08-13