CVE-2026-47646: Dynamics 365 Customer Voice XSS Flaw

CVE-2026-47646 Overview

CVE-2026-47646 is a cross-site scripting (XSS) vulnerability affecting Microsoft Dynamics 365 Customer Voice. The flaw stems from improper neutralization of input during web page generation, categorized under [CWE-79]. An unauthorized attacker can exploit this weakness to perform spoofing attacks over a network when a victim interacts with a crafted link or survey element.

The vulnerability carries a CVSS 3.1 base score of 9.3, driven by the scope change from the vulnerable component to the victim's browser context. Successful exploitation impacts both confidentiality and integrity in the targeted user's session.

Critical Impact
Attackers can inject malicious script into Dynamics 365 Customer Voice pages, hijack user sessions, and spoof legitimate content to harvest credentials or manipulate survey data.

Affected Products

Microsoft Dynamics 365 Customer Voice

Discovery Timeline

2026-07-09 - CVE-2026-47646 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-47646

Vulnerability Analysis

CVE-2026-47646 is a stored or reflected cross-site scripting vulnerability in Dynamics 365 Customer Voice. The application fails to properly neutralize attacker-controlled input before rendering it in a web page. When a targeted user loads the affected page, the browser executes the injected script within the trust context of the Customer Voice domain.

The vulnerability requires user interaction, typically clicking a crafted survey link or opening a manipulated form. Because the scope is changed, the injected script can affect resources beyond the vulnerable component, including the user's authenticated session with adjacent services.

Root Cause

The root cause is missing or insufficient output encoding when user-supplied content is embedded into HTML responses generated by the Customer Voice service. Input received through survey parameters, response fields, or shared URLs is reflected back to browsers without contextual sanitization, allowing HTML and JavaScript payloads to render as active markup.

Attack Vector

The attack vector is network-based and requires no privileges. An unauthenticated attacker crafts a URL or survey artifact containing an XSS payload and distributes it through email, chat, or public channels. When a victim opens the link, the payload executes in the browser, enabling session token theft, DOM manipulation, and spoofed content used for phishing or data exfiltration.

The vulnerability is described in Microsoft's advisory. See the Microsoft Security Update Guide for technical details.

Detection Methods for CVE-2026-47646

Indicators of Compromise

Unusual outbound requests from user browsers to attacker-controlled domains following clicks on Customer Voice survey links.
Anomalous JavaScript payloads or encoded strings (<script>, javascript:, onerror=) present in Customer Voice survey URLs or referrer logs.
Unexpected session token access or authentication anomalies for users who recently interacted with Dynamics 365 Customer Voice content.

Detection Strategies

Inspect web proxy and DNS logs for requests to unfamiliar domains originating from browsers after visits to customervoice.microsoft.com or tenant-specific Customer Voice URLs.
Deploy content security policy (CSP) violation reporting to surface script execution from unauthorized origins.
Correlate email gateway telemetry with user click activity to flag suspicious survey invitations bearing encoded payloads.

Monitoring Recommendations

Monitor Microsoft 365 audit logs for abnormal Dynamics 365 Customer Voice API calls and survey response modifications.
Enable browser and endpoint telemetry to capture script execution context and outbound network activity from user sessions.
Track user-reported phishing attempts referencing Customer Voice surveys and pivot on shared URL indicators.

How to Mitigate CVE-2026-47646

Immediate Actions Required

Apply the Microsoft-provided fix as described in the Microsoft Security Update Guide advisory.
Instruct users to avoid clicking Dynamics 365 Customer Voice links from untrusted or unexpected sources until remediation is confirmed.
Review recent Customer Voice surveys and shared URLs for suspicious content or unauthorized modifications.

Patch Information

Microsoft addresses CVE-2026-47646 as a service-side fix in Dynamics 365 Customer Voice. No customer-installed patch is required for the cloud service, but customers should validate remediation status through the Microsoft Security Update Guide.

Workarounds

Enforce strict Content Security Policy headers in tenant configurations where supported to restrict inline script execution.
Train users to inspect survey URLs and report unexpected Customer Voice invitations to the security team.
Restrict external sharing of Customer Voice surveys until Microsoft confirms the fix is deployed across all tenants.

bash

# Example: sample CSP header to limit script sources on hosted pages
# Content-Security-Policy: default-src 'self'; script-src 'self' https://*.microsoft.com; object-src 'none'; report-uri /csp-report