CVE-2025-62211 Dynamics 365 Field Service (online) Spoofing Vulnerability

Api.Msrc.Microsoft • November 11, 2025

Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities in Microsoft Dynamics 365 Field Service Identified Two spoofing vulnerabilities (CVE-2025-62211 and CVE-2025-62210) have been identified in Dynamics 365 Field Service (online), allowing authorized attackers to perform spoofing via improper input neutralization during web page generation. Additionally, CVE-2025-62206 exposes sensitive information in Dynamics 365 (on-premises) to unauthorized actors over a network. 3 sources 37

Extracted Entities

CVE-2025-62211 Dynamics 365 Field Service (online) Spoofing Vulnerability

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Vulnerabilities (1)