CVE-2024-35260

Deeper analysis

An untrusted search path vulnerability tracked as CVE-2024-35260 affects Microsoft Dataverse. The flaw, assigned CWE-426, permits an attacker to influence executable search paths and was disclosed on 27 June 2024 with a CVSS 3.1 base score of 8.0 reflecting network attack vector, high complexity, high privileges required, no user interaction, and changed scope with high impact on confidentiality, integrity, and availability.

An authenticated attacker with high privileges can exploit the issue remotely over a network to achieve arbitrary code execution. The attack requires the attacker to already possess valid credentials and to arrange malicious components in a location that the Dataverse process will load, resulting in full compromise of the affected service instance.

Microsoft has published official guidance and remediation details in its Security Response Center update guide for this vulnerability. The current and peak EPSS scores remain at 0.0686 with no material increase observed since disclosure.