Cyber Resilience

CVE-2026-33821

High

Published: 12 May 2026

Published
12 May 2026
Modified
15 May 2026
KEV Added
Patch
CVSS Score v3.1 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
EPSS Score 0.0066 47.0th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-33821 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Microsoft Dynamics 365 Customer Insights. Its CVSS base score is 7.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 47.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a network.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Direct match to exploitation for privilege escalation via improper privilege management (CWE-269) allowing an authorized user to elevate access over the network.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-21287Same vendor: Microsoft
CVE-2025-49758Same vendor: Microsoft
CVE-2026-21533Same vendor: Microsoft
CVE-2025-21360Same vendor: Microsoft
CVE-2025-59247Same vendor: Microsoft
CVE-2026-21223Same vendor: Microsoft
CVE-2026-7994Same vendor: Microsoft
CVE-2026-20853Same vendor: Microsoft
CVE-2026-20877Same vendor: Microsoft
CVE-2026-20860Same vendor: Microsoft

Affected Assets

microsoft
dynamics 365 customer insights
all versions

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-269

Policy addresses roles, responsibilities, and privilege management to prevent improper privilege assignments.

addresses: CWE-269

Access supervision ensures privileges are assigned and managed without improper escalation or retention.

addresses: CWE-269

Assigning group/role memberships and access authorizations (privileges) while reviewing accounts addresses improper privilege management.

addresses: CWE-269

Enforces proper privilege management by requiring all decisions through the verified reference monitor.

addresses: CWE-269

By mandating division of duties across roles, the control enforces proper privilege management and prevents a single entity from controlling an entire sensitive process.

addresses: CWE-269

Implements core proper privilege management by restricting to only required rights.

addresses: CWE-269

Policy requires training on privilege management and least privilege, making it harder to exploit improper privilege management weaknesses.

addresses: CWE-269

Training covers proper privilege management practices, making incorrect privilege assignments less likely.

References