CVE-2025-49745: Microsoft Dynamics 365 XSS Vulnerability

CVE-2025-49745 Overview

CVE-2025-49745 is a stored cross-site scripting (XSS) vulnerability in Microsoft Dynamics 365 (on-premises). The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. An unauthorized attacker can craft malicious input that executes in the browser context of another user, enabling spoofing over a network. Exploitation requires user interaction, such as viewing a page containing the injected payload. Microsoft published guidance for this issue through the Microsoft Security Response Center (MSRC).

Critical Impact
An unauthenticated attacker can inject scripts that execute in a victim's browser session, enabling spoofing, impersonation of trusted Dynamics 365 content, and limited disclosure or modification of data accessible to the targeted user.

Affected Products

Microsoft Dynamics 365 (on-premises)
Deployments exposing web-facing Dynamics 365 forms and views
Any on-premises Dynamics 365 instance without the MSRC-published security update applied

Discovery Timeline

2025-08-12 - CVE-2025-49745 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49745

Vulnerability Analysis

The vulnerability exists in the web page generation logic of Microsoft Dynamics 365 (on-premises). The application accepts input from a network-based attacker and reflects or stores that input in generated HTML without adequate encoding or sanitization. When another user renders the affected page, the browser interprets the attacker-controlled content as executable script.

Exploitation requires the victim to interact with a crafted link, view, or record. The attacker does not need prior authentication to submit the payload. Because Dynamics 365 handles customer relationship management (CRM) records and business workflows, injected scripts can spoof interface elements, alter displayed record content, or perform actions in the context of the authenticated victim.

Microsoft classifies the primary security impact as spoofing. The vulnerability carries a network attack vector with low complexity and requires user interaction to trigger.

Root Cause

The root cause is missing or insufficient output encoding when Dynamics 365 embeds user-controlled values into HTML responses. Input intended as data is rendered in a context where the browser parses it as script, matching the pattern described by [CWE-79]. Standard defenses such as context-aware output encoding and strict content security policies are not enforced on the affected code paths.

Attack Vector

An attacker delivers a crafted URL or record containing a script payload to a Dynamics 365 user. The user opens the link or navigates to the affected view within an authenticated Dynamics 365 session. The browser executes the injected script under the origin of the Dynamics 365 site, allowing the attacker to spoof content, exfiltrate session-scoped data visible to the victim, or perform limited actions on the user's behalf.

No verified public proof-of-concept code is available for CVE-2025-49745. Technical specifics remain limited to the Microsoft Security Update Guide entry.

Detection Methods for CVE-2025-49745

Indicators of Compromise

HTTP requests to Dynamics 365 endpoints containing <script>, javascript:, onerror=, or encoded variants in query parameters or form fields
Unexpected outbound requests from user browsers to attacker-controlled domains shortly after visiting Dynamics 365 URLs
Dynamics 365 records containing HTML or script fragments in fields intended for plain text

Detection Strategies

Inspect web server and application logs for anomalous parameter values on Dynamics 365 URLs, especially long or encoded payloads
Apply web application firewall (WAF) rules that flag common XSS payload patterns targeting CRM endpoints
Correlate authenticated user sessions with atypical DOM-modifying activity or unexpected cross-origin requests

Monitoring Recommendations

Enable verbose HTTP request logging on Internet Information Services (IIS) hosting Dynamics 365 and forward logs to a central SIEM
Alert on Dynamics 365 record updates that contain HTML tags in text-only fields
Monitor authentication and audit trails for actions performed immediately after users click external links referencing Dynamics 365 hosts

How to Mitigate CVE-2025-49745

Immediate Actions Required

Apply the security update referenced in the Microsoft Security Update Guide for CVE-2025-49745
Inventory all on-premises Dynamics 365 deployments and confirm patch status
Advise users to avoid clicking untrusted links that reference internal Dynamics 365 URLs until patching is complete

Patch Information

Microsoft has issued a security update addressing CVE-2025-49745 for Microsoft Dynamics 365 (on-premises). Administrators should consult the Microsoft Security Update Guide entry for the exact build numbers, download packages, and installation prerequisites applicable to their deployment.

Workarounds

Restrict network access to Dynamics 365 web interfaces so only trusted networks or VPN clients can reach the application
Deploy a WAF policy that blocks XSS payload patterns targeting Dynamics 365 endpoints
Enforce a strict Content Security Policy (CSP) at the reverse proxy layer to limit inline script execution where compatible with Dynamics 365
Train Dynamics 365 users to report suspicious links referencing CRM records before clicking

bash

# Configuration example
# See the Microsoft Security Update Guide for the applicable
# security update package and installation instructions:
# https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49745