CVE-2025-47732 is a high severity deserialization of untrusted data flaw (CVSS 8.7) in Microsoft Dataverse. The record says an authorized attacker can execute code over a network. The record gives no version list, so read Microsoft's advisory to see what, if anything, you must do.
What's affected
The record says only that Microsoft Dataverse is affected. It lists no versions, no fixed build and no workaround. The Microsoft Security Response Center page named in the record is the authoritative source, but it loads through JavaScript and I could not read its text, so I will not state what it says about patching.
The vector shows network access, low complexity and low privileges. It also requires user interaction, and the scope is changed. Confidentiality and integrity impact are high and availability is not affected. The attacker needs an account that is allowed to use the service, which narrows the pool of attackers but does not remove the risk.
The record does not mark it as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Dataverse is the data platform under Power Apps and Dynamics 365 customer engagement apps. If your organization uses those, you may be a Dataverse customer without having chosen the name.
Check three things:
- Open the Microsoft advisory for CVE-2025-47732 and read the sections on affected products and required action.
- Ask your Power Platform or Dynamics administrator whether any custom code, plugins or integrations run against your environment.
- Review who holds accounts with authoring or maker rights, since the vector requires a privileged account.
Because this is a cloud service, there is usually no package to scan. Your exposure depends on Microsoft's service side fix and on your own account hygiene.
What to do now
- Read the Microsoft advisory and note whether it says customers must act or whether the fix is applied by Microsoft.
- Identify the environments in your tenant that use Dataverse.
- Review users with maker, admin or custom code rights, and remove access that is not needed.
- Require multifactor authentication for those accounts.
- Review audit logs for unexpected plugin or workflow changes during the weeks around the May 2025 publication.
- Record the advisory date and your decision in your vulnerability register.
If you want a quick look at what your own projects pull in, the free in-browser dependency scan at https://gold.safeguard.sh/scan needs no setup. The Gold directory lets you look up other CVEs by id.
Why it matters
The record classifies the weakness as CWE-502, deserialization of untrusted data. Deserialization turns stored or transmitted data back into live objects. If the data comes from someone who should not be trusted, and the program rebuilds objects without strict limits, the data can steer what code runs.
The general defenses are to avoid deserializing untrusted input, to accept only a narrow allow list of types, and to sign or check data before using it. For a hosted service you rely on the vendor for those controls, so your job is to read the advisory, limit privileged accounts and watch the audit trail.
Quick check
Do I need to patch Dataverse myself?
The record lists no versions or patch steps. Read the Microsoft advisory to see whether customers must act.
Is an attacker able to use this without an account?
No. The vector requires low privileges, so the attacker needs an authorized account.
Sources
Last reviewed: 18 October 2026.
