CVE-2025-62206 Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability

Api.Msrc.Microsoft • November 11, 2025

Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclose information over a network.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities in Microsoft Dynamics 365 Field Service Identified Two spoofing vulnerabilities (CVE-2025-62211 and CVE-2025-62210) have been identified in Dynamics 365 Field Service (online), allowing authorized attackers to perform spoofing via improper input neutralization during web page generation. Additionally, CVE-2025-62206 exposes sensitive information in Dynamics 365 (on-premises) to unauthorized actors over a network. 3 sources 37

Extracted Entities

Attack Types (1)

Data Breach

CVEs (1)

CVE-2025-62206