What’s Vulnerable › Vulnerabilities

CVE-2020-16943: Dynamics 365 Commerce Elevation of Privilege Vulnerability

• Severity: low (CVSS 3.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-10-16 · updated 2026-06-17

Description

<p>An elevation of privilege vulnerability exists in Microsoft Dynamics 365 Commerce. An unauthenticated attacker who successfully exploited this vulnerability could update data without proper authorization.</p> <p>To exploit the vulnerability, an attacker would need to send a specially crafted request to an affected server.</p> <p>The security update addresses the vulnerability by correcting how Microsoft Dynamics 365 Commerce performs authorization checks.</p>

Affected products

• Microsoft Dynamics 365 (on-premises) version 9.0: all versions
• Microsoft Dynamics 365 Commerce version 10.0.12: from 10.0.0 before publication — fixed in publication
• Microsoft Dynamics 365 Commerce version 10.0.13: from 10.0.0 before publication — fixed in publication
• Microsoft Dynamics 365 Commerce version 10.0.14: from 10.0.0 before publication — fixed in publication
• Microsoft Dynamics 365 Commerce version 10.0.15: from 10.0.0 before publication — fixed in publication
• Microsoft Dynamics 365 Commerce version 10.0.16: from 10.0.0 before publication — fixed in publication

How to fix

Upgrade to a fixed version: Microsoft Dynamics 365 Commerce version 10.0.12 publication; Microsoft Dynamics 365 Commerce version 10.0.13 publication; Microsoft Dynamics 365 Commerce version 10.0.14 publication; Microsoft Dynamics 365 Commerce version 10.0.15 publication; Microsoft Dynamics 365 Commerce version 10.0.16 publication. Check the vendor advisory for mitigations.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16943
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16943

Get alerted when CVE-2020-16943 or the next vulnerability affects your stack