CVE-2024-38182 Microsoft Dynamics 365 Elevation of Privilege Vulnerability
An unauthenticated attacker can elevate privileges in Microsoft Dynamics 365 Field Service due to weak authentication mechanisms.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-38182?
CVE-2024-38182 is a critical authentication bypass vulnerability in Microsoft Dynamics 365, published on 31 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Weak authentication in Microsoft Dynamics 365 allows an unauthenticated attacker to elevate privileges over a network.
Weakness: CWE-1390
Which versions are affected by CVE-2024-38182?
It affects 1 product.
Products include Microsoft Dynamics 365.
How do I fix CVE-2024-38182?
No fix has been published for CVE-2024-38182 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-38182 being exploited?
There is no known exploitation of CVE-2024-38182 in the wild and no public exploit code.
Other vulnerabilities in Microsoft Dynamics 365
- CVE-2026-47647 Dynamics 365 Elevation of Privilege Vulnerability
- CVE-2026-42898 Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
- CVE-2026-32210 Microsoft Dynamics 365 (online) Spoofing Vulnerability
- CVE-2026-42833 Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
- CVE-2026-65772 Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
Sources
Also known as GHSA-5rh9-r47c-q36p.