CVE-2025-64655 is a high severity (CVSS 8.8) improper authorization flaw in Dynamics OmniChannel SDK Storage Containers, published on 20 November 2025. It lets an unauthorized attacker elevate privileges over a network. Microsoft's data lists no customer action required, so verify that in the update guide.
What's affected
The NVD record gives no version list. It names the product as Dynamics OmniChannel SDK Storage Containers and describes the flaw as improper authorization that allows an unauthorized attacker to elevate privileges over a network. The CVSS vector shows network access, low complexity, no privileges required and a user interaction.
Microsoft's own entry in the update guide adds three facts. Its title is "Dynamics OmniChannel SDK Storage Containers Elevation of Privilege Vulnerability". It states that customer action is not required. And it reports that the flaw was neither publicly disclosed nor exploited at the time of publication, with an exploitability assessment of "Exploitation More Likely". Microsoft rates the issue Critical, while the NVD CVSS score of 8.8 maps to High, so you may see both labels in the wild.
How to check if you're exposed
Because this is a Microsoft hosted component, there is no package version for you to check with a command. Open the advisory page for CVE-2025-64655 in the Microsoft Security Response Center update guide and read the customer action field. As of our review it says no customer action is required.
What you can do locally is know whether you use the component at all. Search your Dynamics 365 omnichannel setup and the code in your own projects for use of the OmniChannel SDK, and keep a record of the result:
grep -rniE "omnichannel" --include=package.json --include=*.csproj --include=*.config . 2>/dev/null
If you ship your own build with SDK references, check the advisory for any updated SDK guidance.
What to do now
- Open the MSRC page for CVE-2025-64655 and confirm whether customer action is required. The data we read says it is not.
- Record whether your organization uses Dynamics OmniChannel and its SDK, and who owns the setup.
- Review storage container access settings and the roles that can reach them, as a general check on authorization.
- Watch the MSRC entry for revisions. Microsoft updates these pages when guidance changes.
- Add the CVE to your tracker with the status of Microsoft remediated unless the advisory changes.
Why it matters
The record lists CWE-285, improper authorization. The software checks who you are but does not correctly check what you may do. When that check is missing or wrong on a storage container, someone without rights can act as someone with them.
We do not have more technical detail than the advisory gives, and we will not guess. The record does not list the CVE in the CISA Known Exploited Vulnerabilities catalog, and Microsoft's data says it was not exploited when published. Still, a service where Microsoft's own exploitability index says exploitation is more likely is worth a short review of whether you depend on it.
Quick check
Do I need to patch anything?
Microsoft's entry says customer action is not required. Confirm on the MSRC page, since it can be revised.
Why do some sources say Critical and others High?
Microsoft rates it Critical. The CVSS base score is 8.8, which falls in the High band. Both describe the same flaw.
Sources
Last reviewed: 18 October 2026.
