CVE-2025-21177: SSRF in Microsoft Dynamics 365 Sales

The SSRF vulnerability in Dynamics 365 Sales allows an attacker who has legitimate access to the system to craft malicious requests that appear to originate from within the trusted network. This can be exploited to access internal resources that are not directly exposed to the internet, such as internal APIs, databases, or other sensitive systems. Successful exploitation could lead to unauthorized data access, modification, or deletion. The ability to elevate privileges means an attacker could potentially gain control over Dynamics 365 Sales functionalities and impact other connected services. While the vulnerability requires authentication, the potential for privilege escalation significantly broadens the attack surface.

1. Reserved2024-12-05
2. Published2025-02-06
3. Modified2026-02-13
4. EPSS updated2026-04-02

The primary mitigation for CVE-2025-21177 is to upgrade to the patched version of Microsoft Dynamics 365 Sales as soon as it becomes available. Until the patch is applied, consider implementing temporary workarounds to restrict outbound network requests from Dynamics 365 Sales. This can be achieved through network segmentation, firewall rules, or web application firewall (WAF) configurations to block requests to internal or sensitive resources. Review and restrict the permissions of Dynamics 365 Sales users to minimize the potential impact of a successful attack. Monitor Dynamics 365 Sales logs for unusual outbound network activity.