CVE-2023-35621 Microsoft Dynamics 365 Finance and Operations Denial of Service Vulnerability
Attackers can cause a denial of service in Microsoft Dynamics 365 Finance and Operations, disrupting business operations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-35621?
CVE-2023-35621 is a high-severity denial of service vulnerability in Microsoft Dynamics 365, published on 12 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Microsoft Dynamics 365 Finance and Operations Denial of Service Vulnerability
Weakness: CWE-799
Which versions are affected by CVE-2023-35621?
It affects 1 product.
Products include Microsoft Dynamics 365.
How do I fix CVE-2023-35621?
No fix has been published for CVE-2023-35621 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-35621 being exploited?
There is no known exploitation of CVE-2023-35621 in the wild and no public exploit code.
Other vulnerabilities in Microsoft Dynamics 365
- CVE-2026-47647 Dynamics 365 Elevation of Privilege Vulnerability
- CVE-2026-42898 Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
- CVE-2026-32210 Microsoft Dynamics 365 (online) Spoofing Vulnerability
- CVE-2026-42833 Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
- CVE-2024-38182 Microsoft Dynamics 365 Elevation of Privilege Vulnerability
Sources
Also known as GHSA-w23x-3qjg-4q5c.