Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-77903: Microsoft Dataverse lets attackers gain higher access

CVE-2026-77903 · published 11 days ago

Summary

The Dataverse platform can be tricked into accepting a fake login, allowing an unauthorized person to act with the rights of a trusted user. This could let them view, change, or delete data across the network. Apply the latest Microsoft updates and review user permissions right away.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
microsoft	microsoft dataverse	-
microsoft	dataverse	All versions `cpe:2.3:a:microsoft:dataverse:-:::::::*`

Original advisory text

Microsoft Dataverse Elevation of Privilege Vulnerability

Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77903 vendor-advisory patch

Severity

9.0 Critical

CVSS 3.1: 9.0 (NVD)

Exploitation

EPSS <1%

Type

CWE-290Authentication Bypass by Spoofing

Timeline

Published17 Sep 2026

Updated27 Sep 2026

First seen17 Sep 2026

Sources

CVE-2026-77903 · NVD

CVE-2026-77903 · MITRE

Track software like this

Free during beta