CVE-2026-77903 is a critical severity (CVSS 9.0) privilege escalation flaw in Microsoft Dataverse. Microsoft lists no customer action for this service. Microsoft has not marked it as exploited at release, and the CISA KEV flag is false. Check the MSRC entry for your exact build.
What's affected
Microsoft Dataverse, a cloud service. Microsoft's data for this CVE lists the customer action required as No, and shows no downloadable update, which fits a service that Microsoft updates itself.
The record does not list versions. Microsoft's September 2026 security update data, which we pulled from the Microsoft Security Response Center API, marks the issue as not publicly disclosed and not exploited at release. The record's KEV flag is false, so there is no sign of exploitation in the wild.
How to check if you're exposed
There is nothing to install for a service Microsoft operates, so there is no version to check. What you can check is your own exposure: who in your organization uses the service, which data it can reach, and what your tenant's access and audit settings look like.
Read the entry in the Microsoft update guide for the current status, since Microsoft can change the notes after release. If your tenant shows any related advisory or message center post, read it.
What to do now
- Open the Microsoft update guide entry for this CVE and confirm the status and any customer guidance.
- Confirm in your admin portal that the service is on its normal update channel, since the fix is applied by Microsoft.
- Review who can use the affected service and what data it can reach, and tighten access where it is broader than needed.
- Review audit logs for unusual activity in the period around the disclosure, and keep logging enabled.
Why it matters
The weakness is CWE-290, authentication bypass by spoofing. Spoofing here means the service can be tricked into accepting a false identity as a real one. Microsoft's description is one line, so we do not know the mechanism and do not guess at one. What the vector does say is that the effect crosses a trust boundary, which is why the scope is marked changed. The practical lesson is to keep an eye on what the service holds, since Dataverse stores business data for apps built on the Power Platform.
The published description is a single sentence, and Microsoft does not add technical detail for most of these issues. That is typical, and it is the reason to judge risk by exposure: who can reach the vulnerable component, and how fast you can patch it. The score reaches 9.0 because the record shows a network attack with no privileges, a changed scope and high impact on all three areas, offset by high complexity.
Quick check
Do I need to install anything?
Microsoft's data lists customer action as not required, so there is no update for you to apply.
Why is it called critical?
The record scores it 9.0, which is the lowest value in the critical band.
Sources
Last reviewed: 18 October 2026.
