CVE-2026-47646
dynamics_365_customer_voice: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVE-2026-47646)
criticalEPSS 0.5%
Description
Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Customer Voice allows an unauthorized attacker to perform spoofing over a network.
Affected products
The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.
microsoftdynamics_365_customer_voice
Metrics
Show all metrics
Severity
critical
80.02
no public PoC known
9.3
Published
2026-07-09 00:17 UTC
CWE-79
Weakness classes (CWE)
CWE-79Base
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
cwe.mitre.org →
References & sources
Reanalysis & status changes
Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.
- Initial Analysis2026-07-09 18:48 UTC· nvd@nist.gov
- CVSS V3.1: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CPE Configuration: OR *cpe:2.3:a:microsoft:dynamics_365_customer_voice:-:*:*:*:*:*:*:*
- Reference Type: Microsoft Corporation: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47646 Types: Vendor Advisory
- New CVE Received2026-07-09 00:17 UTC· secure@microsoft.com
- Affected: Dynamics 365 Customer Voice
- Tag: exclusively-hosted-service
- Description: Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Customer Voice allows an unauthorized attacker to perform spoofing over a network.
- CVSS V3.1: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N