CVE-2020-16943 Dynamics 365 Commerce Elevation of Privilege Vulnerability

What is CVE-2020-16943?

CVE-2020-16943 is a medium-severity missing authorization vulnerability in Microsoft Dynamics 365, published on 16 Oct 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

<p>An elevation of privilege vulnerability exists in Microsoft Dynamics 365 Commerce. An unauthenticated attacker who successfully exploited this vulnerability could update data without proper authorization.</p> <p>To exploit the vulnerability, an attacker would need to send a specially crafted request to an affected server.</p> <p>The security update addresses the vulnerability by correcting how Microsoft Dynamics 365 Commerce performs authorization checks.</p>

Which versions are affected by CVE-2020-16943?

It affects 1 product.

Products include Microsoft Dynamics 365.

How do I fix CVE-2020-16943?

No fix has been published for CVE-2020-16943 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2020-16943 being exploited?

There is no known exploitation of CVE-2020-16943 in the wild and no public exploit code.

Other vulnerabilities in Microsoft Dynamics 365

• CVE-2026-47647 Dynamics 365 Elevation of Privilege Vulnerability Critical 9.9
• CVE-2026-42898 Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability Critical 9.9
• CVE-2026-32210 Microsoft Dynamics 365 (online) Spoofing Vulnerability Critical 9.3
• CVE-2026-42833 Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability Critical 9.1
• CVE-2024-38182 Microsoft Dynamics 365 Elevation of Privilege Vulnerability Critical 9.0

All Microsoft Dynamics 365 vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cwwh-8p3m-623m.